Page History

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="c85ab7dc86fb46f6-8de168c8-4c7d4531-9b28bcda-5330258a2f8ef334b372cbb8"><ac:parameter ac:name="">Apple 06</ac:parameter></ac:structured-macro>
\[Apple 06\] Apple, Inc. [_Secure Coding Guide_|http://developer.apple.com/documentation/Security/Conceptual/SecureCodingGuide/SecureCodingGuide.pdf] (May 2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="b52acf8839de4421-332722c2-4a934850-9b8c9c40-4778890c329ff24b7ccf37ae"><ac:parameter ac:name="">Banahan 03</ac:parameter></ac:structured-macro>
\[Banahan 03\] Banahan, Mike. [The C Book|http://www.phy.duke.edu/~rgb/General/c_book/c_book/index.html] (2003).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="391fb0b6741a8728-93181b88-4c8c4ca8-afd681b3-2a9b6c48254d64df00743776"><ac:parameter ac:name="">Bryant 03</ac:parameter></ac:structured-macro>
\[Bryant 03\] Bryant, Randy; O'Halloran, David. _Computer Systems: A Programmer's Perspective_. Prentice Hall, 2003. ISBN 0-13-034074-X.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5cd799f115f1f9e0-fd7acb91-43854c8a-986199c7-08b297103102110b00e24793"><ac:parameter ac:name="">Burch 06</ac:parameter></ac:structured-macro>
\[Burch 06\] Burch, H.; Long, F.; & Seacord, R. [_Specifications for Managed Strings_|http://www.sei.cmu.edu/publications/documents/06.reports/06tr006.html] (CMU/SEI-2006-TR-006). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="dc98eaf31874705e-51f6765e-48284a3e-82e989d1-9a46ad2caa5c283bfe98795f"><ac:parameter ac:name="">Callaghan 95</ac:parameter></ac:structured-macro>
\[Callaghan 95\] Callaghan, B.; Pawlowski, B.; & Staubach, P. [IETF RFC 1813 NFS Version 3 Protocol Specification|http://www.ietf.org/rfc/rfc1813.txt] (June 1995).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="21227e54983e7ed6-6739d7df-445b48e5-94d2be74-52b3b62b96a9b594da9bf891"><ac:parameter ac:name="">CERT 06a</ac:parameter></ac:structured-macro>
\[CERT 06a\] CERT/CC. [CERT/CC Statistics 1988-2006|http://www.cert.org/stats/cert_stats.html].

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="fef6c63f8dd2c099-4c9de8c1-46754612-840f9da2-78dbe9c327e5503d9d97a90b"><ac:parameter ac:name="">CERT 06b</ac:parameter></ac:structured-macro>
\[CERT 06b\] CERT/CC. US-CERT's [Technical Cyber Security Alerts|http://www.us-cert.gov/cas/techalerts/index.html].

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="8f2743e51e974858-878902a2-4acc4e68-bf88817e-e0a13724787810e1a2270f7a"><ac:parameter ac:name="">CERT 06c</ac:parameter></ac:structured-macro>
\[CERT 06c\] CERT/CC. [Secure Coding|http://www.cert.org/secure-coding/] web site.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="0a5afb1f92d64512-057c1593-445f4c27-adc88a9d-0c893f87478511c9d05eff8b"><ac:parameter ac:name="">Dewhurst 02</ac:parameter></ac:structured-macro>
\[Dewhurst 02\] Dewhurst, Stephen C. _C+\+ Gotchas: Avoiding Common Problems in Coding and Design_. Boston, MA: Addison-Wesley Professional, 2002.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="908ed453f3805ada-0111553b-429a47fe-92f3b5b5-a232a17c77df906f3651d421"><ac:parameter ac:name="">DHS 06</ac:parameter></ac:structured-macro>
\[DHS 06\] U.S. Department of Homeland Security. [Build Security In|https://buildsecurityin.us-cert.gov/].

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5605cd84f0423c09-99140483-4e684e21-ab5cb106-679ffa05cf35a2d55a2b51ff"><ac:parameter ac:name="">Dowd 06</ac:parameter></ac:structured-macro>
\[Dowd 06\] Dowd, M.; McDonald, J.; & Schuh, J. _The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities_. Boston, MA: Addison-Wesley, 2006. See [http://taossa.com] for updates and errata.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="19bc8da398bcfe46-8304ed1f-44dc479b-b3309dae-b106319859005dff679b388f"><ac:parameter ac:name="">Drepper 06</ac:parameter></ac:structured-macro>
\[Drepper 06\] Drepper, Ulrich. [Defensive Programming for Red Hat Enterprise Linux (and What To Do If Something Goes Wrong)|http://people.redhat.com/drepper/defprogramming.pdf] (May 3, 2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9e48ade6166f6749-5bae2110-4c444aa9-bc038ac8-7a9dbd7dd3fe3f5815b81c2e"><ac:parameter ac:name="">FSF 05</ac:parameter></ac:structured-macro>
\[FSF 05\] Free Software Foundation. [GCC online documentation|http://gcc.gnu.org/onlinedocs] (2005).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2f2273a525dd6a22-06f3fa2a-42fd40b9-9180a424-caa0687d3544372053e2702d"><ac:parameter ac:name="">Fortify 06</ac:parameter></ac:structured-macro>
\[Fortify 06\] Fortify Software Inc. [Fortify Taxonomy: Software Security Errors|http://www.fortifysoftware.com/vulncat/] (2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="892d8b35cb3125ab-6f0e4f57-4e4c4e63-ba2d97ab-21ae2c18ea2e9378f654b54a"><ac:parameter ac:name="">Garfinkel 96</ac:parameter></ac:structured-macro>
\[Garfinkel 96\] Simson Garfinkel, Gene Spafford. Practical UNIX & Internet Security. ISBN 1-56592-148-8, 1004 pages.
Second Edition, April 1996.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2b786486bd4913d2-12bc538c-4f174c29-ae669abe-9fb89ebdfa6f6469cffb3d60"><ac:parameter ac:name="">GNU Pth</ac:parameter></ac:structured-macro>
\[GNU Pth\] Engelschall, Ralf S. [GNU Portable Threads|http://www.gnu.org/software/pth/] (2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="08b5fa6024be4dd9-71110645-47e8452f-8fdc9a8a-997b5fd6ac7df9974e0d2f90"><ac:parameter ac:name="">Goldberg 91</ac:parameter></ac:structured-macro>
\[Goldberg 91\] Goldberg, David. [What Every Computer Scientist Should Know About Floating-Point Arithmetic|http://docs.sun.com/source/806-3568/ncg_goldberg.html]. Sun Microsystems, March 1991.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2ca405f0340d8b1e-eb2a435c-41f74d39-8e93b5ab-1ec07fdbcb6bd40e4971acc0"><ac:parameter ac:name="">Graf 03</ac:parameter></ac:structured-macro>
\[Graff 03\] Graff, Mark G. & Van Wyk, Kenneth R. _Secure Coding: Principles and Practices_. Cambridge, MA: O'Reilly, 2003 (ISBN 0596002424).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="3b324094c17cf53d-0aa6d70b-4dc24541-8965ad44-47eee4465c99b49ea1e5db62"><ac:parameter ac:name="">Griffiths 06</ac:parameter></ac:structured-macro>
\[Griffiths 06\] Griffiths, Andrew. "[Clutching at straws: When you can shift the stack pointer|http://felinemenace.org/papers/p63-0x0e_Shifting_the_Stack_Pointer.txt]."&nbsp;

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="8c580200f501085a-887b261a-407a4d7c-b7dd8269-6bd668d0c55b60a69e84d00a"><ac:parameter ac:name="">Haddad 05</ac:parameter></ac:structured-macro>
\[Haddad 05\] Haddad, Ibrahim. "Secure Coding in C and C++: An interview with Robert Seacord, senior vulnerability analyst at CERT." _Linux World Magazine_, November 2005.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="b089c7ad16ae754f-6277ceba-4bb040ca-aed2b536-128033e27136ec0f30ae339c"><ac:parameter ac:name="">Hatton 95</ac:parameter></ac:structured-macro>
\[Hatton 95\] Hatton, Les. _Safer C: Developing Software for High-Integrity and Safety-Critical Systems_. New York, NY: McGraw-Hill Book Company, 1995 (ISBN 0-07-707640-0).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="b7759bf6f6181d88-857b624d-41fa4da2-b6baaa36-43486071179a53173e76ff99"><ac:parameter ac:name="">Horton 90</ac:parameter></ac:structured-macro>
\[Horton 90\] Mark R. Horton. Portable C software. Prentice-Hall, Inc. Upper Saddle River, NJ. 1990. ISBN:0-13-868050-7

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="85a038deabbf0e08-66f01ab3-439f4a45-b3d1920c-09ec38202552dbd5532e2c4c"><ac:parameter ac:name="">Howard 02</ac:parameter></ac:structured-macro>
\[Howard 02\] Michael Howard, David C. LeBlanc. [Writing Secure Code, Second Edition|http://www.microsoft.com/mspress/books/5957.aspx] Microsoft Press; 2 Sub edition (December, 2002).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d99161839526448a-04d9673d-40d2438b-a3698881-8b27a6e66adb2dd69da9bf1d"><ac:parameter ac:name="">HP 03</ac:parameter></ac:structured-macro>
\[HP 03\] [Tru64 UNIX: Protecting Your System Against File Name Spoofing Attacks|http://h30097.www3.hp.com/docs/wpapers/spoof_wp/symlink_external.pdf]. Houston, TX: Hewlett-Packard Company, January 2003.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9d8de199adeddfc5-3ef60602-4e294275-a3a58916-3a652ba18ac81db91dccf182"><ac:parameter ac:name="">IEC 60812 2006</ac:parameter></ac:structured-macro>
\[IEC 60812 2006\] _Analysis techniques for system reliability - Procedure for failure mode and effects analysis (FMEA)_, 2nd ed. (IEC 60812). (IEC 60812). IEC, January 2006 IEC, January 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2038154a3c0e5d6d-efb1401e-48d245ed-9fd2bd84-263227173625c25b239a47a7"><ac:parameter ac:name="">IEEE 754 2006</ac:parameter></ac:structured-macro>
\[IEEE 754 2006\] IEEE. [_Standard for Binary Floating-Point Arithmetic_|http://grouper.ieee.org/groups/754/] (IEEE 754-1985) (2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5ed2f1b227465801-996eb5d4-415b488d-8e2bb1f3-3ae12dc5cc76c3906094195e"><ac:parameter ac:name="">ilja 06</ac:parameter></ac:structured-macro>
\[ilja 06\] ilja. "[readlink abuse|http://blogs.23.nu/ilja/stories/12551/]." _ilja's blog_, August 13, 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="23bf03e9c31d7490-a1d24931-4df5498c-98b4a39c-0a8d1723eb0da82cb79fec12"><ac:parameter ac:name="">ISO/IEC 646-1991</ac:parameter></ac:structured-macro>
\[ISO/IEC 646-1991\] ISO/IEC. _Information technology: ISO 7-bit coded character set for information interchange_ (ISO/IEC 646-1991). Geneva, Switzerland: International Organization for Standardization, 1991.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="4524462880b4bfdb-cc3afdd0-412a4940-946597d3-1bf1996700dbd5db414b6555"><ac:parameter ac:name="">ISO/IEC 9899-1999</ac:parameter></ac:structured-macro>
\[ISO/IEC 9899:1999\] ISO/IEC. _Programming Languages --- C, Second Edition_ (ISO/IEC 9899:1999). Geneva, Switzerland: International Organization for Standardization, 1999.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="c2d098885ba867b8-8cdb1008-497a430e-a1dabf18-0c2a1ef567a4eee679929079"><ac:parameter ac:name="">ISO/IEC 14882-2003</ac:parameter></ac:structured-macro>
\[ISO/IEC 14882-2003\] ISO/IEC. _Programming Languages --- C++, Second Edition_ (ISO/IEC 14882-2003). Geneva, Switzerland: International Organization for Standardization, 2003.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="f49954529dc87505-d8135164-4150487a-810ba73e-18a3155535ef55e7f857f3ac"><ac:parameter ac:name="">ISO/IEC 03</ac:parameter></ac:structured-macro>
\[ISO/IEC 03\] ISO/IEC. [_Rationale for International Standard --- Programming Languages --- C, Revision 5.10_|http://www.open-std.org/jtc1/sc22/wg14/www/C99RationaleV5.10.pdf]. Geneva, Switzerland: International Organization for Standardization, April 2003.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="0af5a4e48d3fd783-197251e5-40944570-bbd28543-6375dc44577e29b5c82d5651"><ac:parameter ac:name="">ISO/IEC JTC1/SC22/WG11</ac:parameter></ac:structured-macro>
\[ISO/IEC JTC1/SC22/WG11\] ISO/IEC. [_Binding Techniques_|http://www.open-std.org/JTC1/SC22/WG11/] (ISO/IEC JTC1/SC22/WG11) (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="dbfb5d32c4286754-7791f4ef-41ec45bc-9a1080c6-c7c64ee94149b239c0237e36"><ac:parameter ac:name="">ISO/IEC TR 24731-1-2007</ac:parameter></ac:structured-macro>
\[ISO/IEC TR 24731-1-2007\] ISO/IEC TR 24731. _Extensions to the C Library, --- Part I: Bounds-checking interfaces_. Geneva, Switzerland: International Organization for Standardization, April 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="a6728c61c675f8d1-8d08d90b-47814101-86b89e71-b34711c2d014e9a8f59035c1"><ac:parameter ac:name="">Jack 07</ac:parameter></ac:structured-macro>
\[Jack 07\] Jack, Barnaby. [_Vector Rewrite Attack_|http://www.juniper.net/solutions/literature/white_papers/Vector-Rewrite-Attack.pdf] (May 2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="ccb5c0736fb7ee3c-13b70282-4a574610-abd4bfd7-59515d958847240c3ee87321"><ac:parameter ac:name="">Kennaway 00</ac:parameter></ac:structured-macro>
\[Kennaway 00\] Kennaway, Kris. [Re: /tmp topic|http://lwn.net/2000/1221/a/sec-tmp.php3] (December 2000).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d504643a2d682d25-563e1fb4-471c4da7-8c008871-da5941da619473e370ba083b"><ac:parameter ac:name="">Kerrighan 88</ac:parameter></ac:structured-macro>
\[Kerrighan 88\] Kerrighan, B. W. & Ritchie, D. M. _The C Programming Language, 2nd ed._ Englewood Cliffs, NJ: Prentice-Hall, 1988.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="804949dbc3e64da5-3c9b8e25-4d7c4d32-9d48b4d7-d4b407c5123b3c5dde7cb4fd"><ac:parameter ac:name="">Kettle 02</ac:parameter></ac:structured-macro>
\[Kettlewell 02\] Kettlewell, Richard. [_C Language Gotchas_|http://www.greenend.org.uk/rjk/2001/02/cfu.html] (February 2002).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="7a9c206d09d96f82-4713bc17-459c4923-9bba8385-aa5b0650f469b741ccc6e886"><ac:parameter ac:name="">Kettle 03</ac:parameter></ac:structured-macro>
\[Kettlewell 03\] Kettlewell, Richard. [_Inline Functions In C_|http://www.greenend.org.uk/rjk/2003/03/inline.html] (March 2003).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5c99983356d6b605-b7d77615-45004166-bf3da053-7f6c122558be69b42a40c9f6"><ac:parameter ac:name="">Kirch-Prinz 02</ac:parameter></ac:structured-macro>
\[Kirch-Prinz 02\] Ulla Kirch-Prinz, Peter Prinz. _C Pocket Reference_.  O'Reilly. November 2002 ISBN: 0-596-00436-2.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="c9d2d4c2a80cf06c-6fbdb381-43fe4cff-bbcca4a1-5fff8f2180160bc56645b625"><ac:parameter ac:name="">Klein 02</ac:parameter></ac:structured-macro>
\[Klein 02\] Klein, Jack. [_Bullet Proof Integer Input Using strtol()_|http://home.att.net/~jackklein/c/code/strtol.html] (2002).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="032cc635b359bdb5-bea539ea-4561445a-9eb49633-d1e82b3b61f43e5e20d36484"><ac:parameter ac:name="">Koenig 89</ac:parameter></ac:structured-macro>
\[Koenig 89\]
Andrew Koenig. C Traps and Pitfalls. Addison-Wesley Professional (January 1, 1989)

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="1dc3992b8087c9fb-bd0c5c46-42dc49c2-aa9899ca-b0b1aa2c4d38ac76ccd72344"><ac:parameter ac:name="">Kuhn 06</ac:parameter></ac:structured-macro>
\[Kuhn 06\] Kuhn, Markus. [_UTF-8 and Unicode FAQ for Unix/Linux_|http://www.cl.cam.ac.uk/~mgk25/unicode.html] (2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="e380bd184278b1ce-237d54f1-493e458a-843f95a0-ec7d2a97940add9868d3ebff"><ac:parameter ac:name="">Lai 06</ac:parameter></ac:structured-macro>
\[Lai 06\] Lai, Ray. "[Reading Between the Lines|http://undeadly.org/cgi?action=article&sid=20061027031811]." _OpenBSD Journal_, October 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9767f2737c585e86-0cad80cd-44414deb-8397b73d-4328a38e676712163f638c9e"><ac:parameter ac:name="">Lions 96</ac:parameter></ac:structured-macro>
\[Lions 96\] Lions, J. L. [ARIANE 5 Flight 501 Failure Report|http://en.wikisource.org/wiki/Ariane_501_Inquiry_Board_report]. Paris, France: European Space Agency (ESA) & National Center for Space Study (CNES) Inquiry Board, July 1996.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2d8b4cfe9f1eea65-7a924ac2-4fbe421d-a5288891-581585f324a0dccf97eafa30"><ac:parameter ac:name="">Lockheed Martin 2005</ac:parameter></ac:structured-macro>
\[Lockheed Martin 2005\] Lockheed Martin. _Joint Strike Fighter Air Vehicle C+\+ Coding Standards for the System Development and Demonstration Program_. Document Number 2RDU00001, Rev C.  December 2005.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="ae845481a8b15591-33bf9584-4a81400d-83e6b9ae-ee33e6bb6f03d9de957da0fe"><ac:parameter ac:name="">McCluskey 01</ac:parameter></ac:structured-macro>
\[McCluskey 01\] [_flexible array members and designators in C9X_|http://www.usenix.org/publications/login/2001-07/pdfs/mccluskey.pdf] ;login:, July 2001, Volume 26, Number 4, p. 29-32

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="1cc8398b8b811c00-5555cca9-44764ffb-8c0b98e8-8b456959a2b31c34b0e005b1"><ac:parameter ac:name="">mercy</ac:parameter></ac:structured-macro>
\[mercy\] mercy. [_Exploiting Uninitialized Data_|http://www.felinemenace.org/papers/UBehavior.zip] (January 2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="0a98a9542606b97e-d1223982-41404c54-a9a88e1a-7b1bc5e0c65ccdf23ffe21e4"><ac:parameter ac:name="">MISRA 04</ac:parameter></ac:structured-macro>
\[MISRA 04\] MISRA Limited. "[MISRA C|http://www.misra.org.uk/]: 2004 Guidelines for the Use of the C Language in Critical Systems." Warwickshire, UK: MIRA Limited, October 2004 (ISBN 095241564X).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5880d0851e776185-508e9b86-493143ad-926a9c07-ed6082d23f30baa804af0033"><ac:parameter ac:name="">Microsoft 07</ac:parameter></ac:structured-macro>
\[Microsoft 07\] [C Language Reference|http://msdn2.microsoft.com/en-us/library/fw5abdx6(VS.80).aspx]. 2007.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="bf5c2de04d55bcb6-f102dc38-4f2a4641-97898170-47b4c4c5fa38166d3787f5d1"><ac:parameter ac:name="">MIT 05</ac:parameter></ac:structured-macro>
\[MIT 05\] MIT. "[MIT krb5 Security Advisory 2005-003|http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-003-recvauth.txt] (2005).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2a15f9bb340596a6-1c44ce0d-45624a43-828cb9a4-dca3bb877b4aa741dcb17f54"><ac:parameter ac:name="">MITRE 07</ac:parameter></ac:structured-macro>
\[MITRE 07\] MITRE. [Common Weakness Enumeration, Draft 7|http://cwe.mitre.org/].  October, 2007.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="fe98f83778c9402b-4e923d94-4f9041b3-a9419711-d1c5785588692a42c58a76fd"><ac:parameter ac:name="">MSDN 07</ac:parameter></ac:structured-macro>
\[MSDN 07\] MSDN. [Inheritance (Windows)|http://msdn2.microsoft.com/en-us/library/ms683463.aspx] (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d8fc23d99237733f-0e936f0e-43cb4af5-b9908623-b1aada533186914112daa6af"><ac:parameter ac:name="">NAI 98</ac:parameter></ac:structured-macro>
\[NAI 98\] Network Associates Inc. [Bugtraq: Network Associates Inc. Advisory (OpenBSD)|http://seclists.org/bugtraq/1998/Aug/0071.html] (1998).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="b8216a7e2e0f2281-0ab773a6-45334f69-9c69b2a7-9a077b81142eedba768fcfba"><ac:parameter ac:name="">NASA-GB-1740.13</ac:parameter></ac:structured-macro>
\[NASA-GB-1740.13\] NASA Glenn Research Center, Office of Safety Assurance Technologies. [_NASA Software Safety Guidebook_|http://pbma.nasa.gov/docs/public/pbma/general/guidbook.doc] (NASA-GB-1740.13).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="0ef3d3abb3796879-d27f77fb-483147b7-b0b7994c-fc104ca36e2eeb99b7906eea"><ac:parameter ac:name="">NIST 06</ac:parameter></ac:structured-macro>
\[NIST 06\] NIST. [_SAMATE Reference Dataset_|http://samate.nist.gov/SRD/] (2006).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="f55dd901a879751e-97131c18-477a46fe-be3788c2-5cfa38e03eefaf693e747c98"><ac:parameter ac:name="">NIST 06b</ac:parameter></ac:structured-macro>
\[NIST 06b\] NIST. [DRAFT Source Code Analysis Tool Functional Specification. | http://samate.nist.gov/docs/SAMATE_source_code_analysis_tool_spec_09_15_06.pdf] NIST Information Technology Laboratory (ITL), Software Diagnostics and Conformance Testing Division, September 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="ad5e3deec05bf75a-97ec48f6-471a4297-8908a7c8-c1db5a19277911eea6d5a12a"><ac:parameter ac:name="">Open Group 97</ac:parameter></ac:structured-macro>
\[Open Group 97\] The Open Group. [_The Single UNIX® Specification, Version 2_|http://www.opengroup.org/onlinepubs/7990989775/toc.htm] (1997).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5c09dfa6262b633e-78141917-4a8540c0-9127977c-acfb1ae10899f427b86519cc"><ac:parameter ac:name="">Open Group 97b</ac:parameter></ac:structured-macro>
\[Open Group 97b\] The Open Group. [_Go Solo 2 - The Authorized Guide to Version 2 of the Single UNIX Specification_|http://www.unix.org/whitepapers/64bit.html] (May 1997).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="0b665224c84d4574-e72d7d90-4fba4fcd-a38ca83e-3117ea5912dcf6ae38347e5d"><ac:parameter ac:name="">Open Group 04</ac:parameter></ac:structured-macro>
\[Open Group 04\] The Open Group and the IEEE. [_The Open Group Base Specifications Issue 6, IEEE Std 1003.1, 2004 Edition_|http://www.opengroup.org/onlinepubs/009695399/toc.htm] (2004).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="bf57fe0c54e05d6e-c969aade-47054bee-990d8df9-918ad65cf2dffec7f8149e26"><ac:parameter ac:name="">Plakosh 05</ac:parameter></ac:structured-macro>
\[Plakosh 05\] Plakosh, Dan. _[_Consistent Memory Management Conventions_|https://buildsecurityin.us-cert.gov/daisy/bsi/articles/knowledge/coding/476.html]_ (2005).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="62c54bf5a3e2f517-06801966-4c2347c7-ac29b92f-dbcf1bed0b2730c25d0ec475"><ac:parameter ac:name="">Plum 85</ac:parameter></ac:structured-macro>
\[Plum 85\] Plum, Thomas. _Reliable Data Structures in C_. Kamuela, HI: Plum Hall, Inc., 1985 (ISBN 0-911537-04-X).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="e4d395cf9fde0342-54b2de68-456946a1-bcdea1c6-6683da6e15dca68ceb0f0291"><ac:parameter ac:name="">Plum 89</ac:parameter></ac:structured-macro>
\[Plum 89\] Plum, Thomas, & Saks, Dan. _C Programming Guidelines, 2nd ed_. Kamuela, HI: Plum Hall, Inc., 1989 (ISBN 0911537074).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d4c345e56a2bdd59-82df0c3a-40c04de7-a6c4b23b-553e7cc06be65169136a0244"><ac:parameter ac:name="">Plum 91</ac:parameter></ac:structured-macro>
\[Plum 91\] Plum, Thomas. _C+\+ Programming_. Kamuela, HI: Plum Hall, Inc., 1991 (ISBN 0911537104).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="3eef1fe86bbb1ed6-869ef37e-49544144-916a9e66-c31a92036c110e3737e2d3ee"><ac:parameter ac:name="">Redwine 06</ac:parameter></ac:structured-macro>
\[Redwine 06\] Redwine, Samuel T., Jr., ed. _Secure Software Assurance: A Guide to the Common Body of Knowledge to Produce, Acquire, and Sustain Secure Software Version 1.1_. U.S. Department of Homeland Security, September 2006. See [Software Assurance Common Body of Knowledge|https://buildsecurityin.us-cert.gov/daisy/bsi/resources/dhs/95.html] on Build Security In.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9f7d4f9e512a372e-921adf04-4d4f4514-a519bcce-0ff1889dc38baf2b7ac47971"><ac:parameter ac:name="">Saks 99</ac:parameter></ac:structured-macro>
\[Saks 99\] Saks, Dan. "[const T vs.T const|http://www.dansaks.com/articles/1999-02%20const%20T%20vs%20T%20const.pdf]." _Embedded Systems Programming_, February 1999, pp. 13-16.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5f596512c8c58d13-80051d93-4d6e42c3-b4568194-ae4d35a4f13a0271eaba4752"><ac:parameter ac:name="">Saks 07</ac:parameter></ac:structured-macro>
\[Saks 07\] Saks, Dan. "[Sequence Points|http://www.embedded.com/columns/programmingpointers/9900661?_requestid=481957]" Embedded Systems Design, 07/01/02.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="30149a07ef166a94-3868a858-46ea4d1e-b544845b-2858f1eb00ab70e5fcc9f9a1"><ac:parameter ac:name="">Schwarz 05</ac:parameter></ac:structured-macro>
\[Schwarz 05\] Schwarz, B. Hao Chen Wagner, D. Morrison, G. West, J. Lin, J. Wei Tu. _Model checking an entire Linux distribution for security violations_. Published in proceedings of the 21st Annual Computer Security Applications Conference.  Dec. 2005. ISSN: 1063-9527. ISBN: 0-7695-2461-3.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="7cc2c4552e995f0d-6c205b37-44074d27-b36a8c7e-dcdf1a4082f669c7c773d2b2"><ac:parameter ac:name="">Seacord 05</ac:parameter></ac:structured-macro> <ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="ebf412ec7a0bbdb3-155edd70-46654754-880cbdb9-c5eae66583920ff55b4e8292"><ac:parameter ac:name="">Seacord 05a</ac:parameter></ac:structured-macro>
\[Seacord 05a\] Seacord, R. _Secure Coding in C and C+\+_. Boston, MA: Addison-Wesley, 2005. See [http://www.cert.org/books/secure-coding] for news and errata.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="48b22df2f62e0325-92cd80c0-444a40f1-a4bd98c3-a572b55e25f27e16d267a384"><ac:parameter ac:name="">Seacord 05b</ac:parameter></ac:structured-macro>
\[Seacord 05b\] Seacord, R. "Managed String Library for C, C/C++." _Users Journal_ _23_, 10 (October 2005): 30-34.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="6830d560bf7dd4eb-1f9ba37a-4db142ab-bb88a64f-102abdb5972ca8ba3cd4fd69"><ac:parameter ac:name="">Spinellis 06</ac:parameter></ac:structured-macro>
\[Spinellis 06\] Spinellis, Diomidis. [_Code Quality: The Open Source Perspective_|http://www.spinellis.gr/codequality].  Addison-Wesley, 2006.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="8214ee394704e246-9dc54e2a-4d72459e-aa04b3e1-2e06ff0759bcc0b3ffcdfaa4"><ac:parameter ac:name="">Steele 77</ac:parameter></ac:structured-macro>
\[Steele 77\]  Steele, G. L. 1977. [Arithmetic shifting considered harmful.|http://doi.acm.org/10.1145/956641.956647] _SIGPLAN Not._ 12, 11 (Nov. 1977), 61-69.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="52f187d1569fc9a5-1cad1747-49eb4115-bcd3b1ae-788b436c0316ac3607214046"><ac:parameter ac:name="">Summit 95</ac:parameter></ac:structured-macro>
\[Summit 95\] Summit, Steve. _C Programming FAQs: Frequently Asked Questions_. Boston, MA: Addison-Wesley, 1995 (ISBN 0201845199).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d6be276cf13c9125-212f87a8-44394e77-863f8553-ff9b57434bf511b7aa98f750"><ac:parameter ac:name="">Summit 05</ac:parameter></ac:structured-macro>
\[Summit 05\] Summit, Steve. [_comp.lang.c Frequently Asked Questions_|http://c-faq.com/] (2005).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="a56b07e9bbed9484-dfe9eeb4-41c545ea-96739ea3-afb9ed90802d28fce1e3253d"><ac:parameter ac:name="">Sun 05</ac:parameter></ac:structured-macro>
\[Sun 05\] [C User's Guide|http://docs.sun.com/source/819-3688/]. 819-3688-10. Sun Microsystems, Inc. (2005)

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="dd642a0e70655775-b9dc4f67-45a9403e-8a7ab8b6-7f0c70f5fc0fdcd89b37fd70"><ac:parameter ac:name="">van de Voort 07</ac:parameter></ac:structured-macro>
\[van de Voort 07\] van de Voort, Marco. [Development Tutorial (a.k.a Build FAQ)|http://www.stack.nl/~marcov/buildfaq.pdf] (January 29, 2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="df03b26679577411-94722c6e-4bde4c79-b95fa120-3e0316306d39a830a0a599e2"><ac:parameter ac:name="">Viega 03</ac:parameter></ac:structured-macro>
\[Viega 03\] Viega, John & Messier, Matt. _Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Networking, Input Validation & More_. Sebastopol, CA: O'Reilly, 2003 (ISBN 0-596-00394-3).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="42132eee2b487691-94eb7244-4f3c4736-a43cadfd-4bb899e51176b06fa9afcb30"><ac:parameter ac:name="">Viega 05</ac:parameter></ac:structured-macro>
\[Viega 05\] Viega, John. [CLASP Reference Guide Volume 1.1.|http://www.securesoftware.com/process/] Secure Software, 2005.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="510b404ceb356648-7b23fe5e-4ca64195-a5d1b0e5-8f86e1b060e746d17df30f01"><ac:parameter ac:name="">VU196240</ac:parameter></ac:structured-macro>
\[VU#196240\] Taschner, Chris & Manion, Art. Vulnerability Note [VU#196240|http://www.kb.cert.org/vulnotes/id/196240], _Sourcefire Snort DCE/RPC preprocessor does not properly reassemble fragmented packets_ (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9d1c6ea9d77f8680-e497e45e-4e61411c-bef586c3-3c388459b3067aeea75883ca"><ac:parameter ac:name="">VU286468</ac:parameter></ac:structured-macro>
\[VU#286468\] Burch, Hal. Vulnerability Note [VU#286468|http://www.kb.cert.org/vulnotes/id/286468], _Ettercap contains a format string error in the "curses_msg()" function_ (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="bcf0ca71a099bfb1-4858a076-4931427e-9351a6ad-0b278d61bfdb72ba77bebf1c"><ac:parameter ac:name="">VU#551436</ac:parameter></ac:structured-macro>
\[VU#551436\] Giobbi, Ryan. Vulnerability Note [VU#551436|http://www.kb.cert.org/vulnotes/id/551436], _Mozilla Firefox SVG viewer vulnerable to buffer overflow_ (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="600bf63154ce2c4c-8aaff1ee-49564084-a440b9fb-72520982dcd3e39406ae36e4"><ac:parameter ac:name="">VU623332</ac:parameter></ac:structured-macro>
\[VU#623332\] Mead, Robert. Vulnerability Note [VU#623332|http://www.kb.cert.org/vuls/id/623332], _MIT Kerberos 5 contains double free vulnerability in "krb5_recvauth()" function_ (2005).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="1d596bcd555d44b4-a7c38a47-44544e19-b4bd8eee-19941153405628874b68f67f"><ac:parameter ac:name="">VU649732</ac:parameter></ac:structured-macro>
\[VU#649732\] Gennari, Jeff. Vulnerability Note [VU#649732|http://www.kb.cert.org/vulnotes/id/649732], _Samba AFS ACL mapping VFS plug-in format string vulnerability_ (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="c079d95ea3938705-0e5cf0d5-4eb64144-9735ad52-e9c7d77f619c8b4ae483b759"><ac:parameter ac:name="">VU743092</ac:parameter></ac:structured-macro>
\[VU#743092\] Jason A. Rafail; Jeffrey S. Havrilla.  Vulnerability Note [VU#743092|https://www.kb.cert.org/vulnotes/id/743092], _realpath(3) function contains off-by-one buffer overflow_. July, 2003.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="72a3d42f02c49e83-c1d41202-42e64d26-8024810b-04d75b700391a626ff3bbf75"><ac:parameter ac:name="">VU881872</ac:parameter></ac:structured-macro>
\[VU#881872\] Manion, Art & Taschner, Chris. Vulnerability Note [VU#881872|http://www.kb.cert.org/vulnotes/id/881872], _Sun Solaris telnet authentication bypass vulnerability_ (2007).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="93aaf6b17523a420-e9aaf896-47b54751-b94cb444-68d9719c392eb4aaa807c743"><ac:parameter ac:name="">Warren 02</ac:parameter></ac:structured-macro>
\[Warren 02\] Warren, Henry S. [_Hacker's Delight_|http://www.hackersdelight.org/]. Boston, MA: Addison Wesley Professional, 2002 (ISBN 0201914654).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="f80f41a405ecafef-738bd925-4e054975-880f9b82-2fe3491ce775b23234d45727"><ac:parameter ac:name="">Wheeler 03</ac:parameter></ac:structured-macro>
\[Wheeler 03\] Wheeler, David. [Secure Programming for Linux and Unix HOWTO, v3.010 |http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/] (March 2003).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="9092c5309c230a69-368d1b38-41d44833-bd66bd79-9ff248179f14e3a49da821bb"><ac:parameter ac:name="">Yergeau 98</ac:parameter></ac:structured-macro>
\[Yergeau 98\] Yergeau, F. [RFC 2279 - UTF-8, a transformation format of ISO 10646|http://www.faqs.org/rfcs/rfc2279.html] (January 1998).

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="94aa111a58dd9e58-70f341a4-40fa4e70-8737833b-04258bf859756af92db360cd"><ac:parameter ac:name="">Zalewski 01</ac:parameter></ac:structured-macro>
\[Zalewski 01\] Michal Zalewski. [_Delivering Signals for Fun and Profit: Understanding, exploiting and preventing signal-handling related vulnerabilities_|http://lcamtuf.coredump.cx/signals.txt],  May, 2001.