Page History

Anchor
Acton 06 Acton 06

[Acton 2006] Acton, Mike. "Understanding Strict Aliasing." CellPerformance, June 1, 2006.

Anchor
Aho 1986 Aho 1986

[Aho 1986] Aho, Alfred V.; Sethi, Ravi; Ullman, Jeffrey D. "Compilers: Principles, Techniques, and Tools" (2nd ed.), 1986.

Anchor
Apiki 2006 Apiki 2006

[Apiki 2006] Apiki, Steve. "Lock-Free Programming on AMD Multi-Core System." AMD Developer Central, 2006.

...

Anchor
Asgher 2000 Asgher 2000

[Asgher 2000] Asgher, Sarmad. "Practical Lock-Free Buffers." Dr. Dobbs Go-Parallel, August 26, 2000.

Anchor
Austin Group 08	Austin Group 08

[Austin Group 2008] "Draft Standard for Information Technology—Portable Operating System Interface (POSIX®)—Draft Technical Standard: Base Specifications, Issue 7," IEEE Unapproved Draft Std P1003.1 D5.1. Prepared by the Austin Group. New York: Institute of Electrical & Electronics Engineers, Inc., May 2008.

Bailey 14 Bailey 14

[Bailey 2014] Bailey, Don A. Raising Lazarus—The 20 Year Old Bug that Went to Mars . 2014.

Anchor
Banahan 03 Banahan 03

[Banahan 2003] Banahan, Mike. The C Book . 2003.

...

Anchor
Black 07 Black 07

[Black 2007] Black, Paul E., ; Kass, Michael, ; & Koo, Michael. Source Code Security Analysis Tool Functional Specification Version 1.0. Special Publication 500-268. Information Technology Laboratory (ITL), Software Diagnostics and Conformance Testing Division, May 2007. http://samate.nist.gov/docs/source_code_security_analysis_spec_SP500-268.pdf.

Anchor
Brainbell.com Brainbell.com

[Brainbell.com] Brainbell.com. Advice and Warnings for C Tutorials .

Anchor
Bryant 03 Bryant 03

[Bryant 2003] Bryant, Randal E. , & O'Halloran, David. Computer Systems: A Programmer's Perspective. Upper Saddle River, NJ: Prentice Hall, 2003 (ISBN 0-13-034074-X).

Anchor
Burch 06 Burch 06

[Burch 2006] Burch, Hal, ; Long, Fred, ; & Seacord, Robert C. Specifications for Managed Strings (CMU/SEI-2006-TR-006). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2006.

...

Anchor
C99 2003 C99 2003

[C99 Rationale 2003] Rationale for International Standard—Programming Languages—C, Revision 5.10 (C99 Rationale), April 2003. http://www.open-std.org/jtc1/sc22/wg14/www/C99RationaleV5.10.pdf.

Anchor
Callaghan 95 Callaghan 95

[Callaghan AnchorCallaghan 95Callaghan 95 [Callaghan 1995] Callaghan, B., ; Pawlowski, B., ; & Staubach, P. IETF RFC 1813 NFS Version 3 Protocol Specification, June 1995.

Anchor
Cassidy 2014 Cassidy 2014

[Cassidy 2014] Cassidy, Sean. existential type crisis : Diagnosis of the Heartbleed Bug [blog post]. April 2014.

Anchor
CERT 06a CERT 06a

[CERT 2006a] CERT/CC. CERT/CC Statistics 1988–2006.

...

Anchor
Chen 02 Chen 02

[Chen 2002]  Chen, H., ; Wagner, D., ; & Dean, D. Setuid Demystified. USENIX Security Symposium, 2002.

...

Anchor
DHS 06 DHS 06

[DHS 2006] U.S. Department of Homeland Security. Build Security In. 2006.

Anchor
DISA 2008 DISA 2008

Anchor
DISA 2015 DISA 2015

[DISA 20082015] DISA. Application Security and Development Security Technical Implementation Guide, Version 23, Release 1. July 200810. Accessed April 2015.

Anchor
DOD 5220	DOD 5220
DISA 2016 DISA 2016

[DISA 2016] DISA. Application Security and Development Security Technical Implementation Guide, Version 4, Release 1. Accessed January 2017.

Anchor
DISA 2018 DISA 2018

[DISA 2018] DISA. Application Security and Development Security Technical Implementation Guide, Version 4, Release 8. Accessed January 2019.

Anchor
DOD 5220 DOD 5220

[DOD 5220 [DOD 5220] U.S. Department of Defense. DoD Standard 5220.22-M (Word document).

Anchor
Dowd 06 Dowd 06

[Dowd 2006] Dowd, M., ; McDonald, J., ; & Schuh, J. The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities. Boston: Addison-Wesley, 2006. See http://taossa.com for updates and errata.

Anchor
Drepper 06 Drepper 06

[Drepper 2006] Drepper, Ulrich. Defensive Programming for Red Hat Enterprise Linux (and What To Do If Something Goes Wrong). May 3, 2006.

Anchor
Duff 88 Duff 88 Dutta 03 Dutta 03

[Duff 1988] Duff, Tom. Tom Duff on Duff's Device. August 29, 1988.

Anchor
Dutta 03 Dutta 03

[Dutta 2003] Dutta 2003] Dutta, Shiv. Best Practices for Programming in C. June 26, 2003.

...

Anchor
Eide and Regehr Eide and Regehr

[Eide and Regehr] Eide, E., & Regehr, J. Volatiles Are Miscompiled, and What to Do about It. 2008.

Anchor
Feather 97 Feather 97

[Feather 1997] Feather, Clive, D. W. Solving the struct Hack Problem. JTC1/SC22/WG14 N791. (1997).

Anchor
Finlay 03 Finlay 03

[Finlay 2003] Finlay, Ian A. CERT Advisory CA-2003-16, Buffer Overflow in Microsoft RPC. CERT/CC, July 2003.

Anchor
Fisher 99 Fisher 99

[Fisher 1999] Fisher, David, David & Lipson, Howard. "Emergent Algorithms—A New Method for Enhancing Survivability in Unbounded Systems." Proceedings of the 32nd Annual Hawaii International Conference on System Sciences (HICSS-32). Maui, HI, January 5–8, 1999.

...

Anchor
Fortify 06 Fortify 06

[Fortify 2006] Fortify Software Inc. Fortify Taxonomy: Software Security Errors. 2006.

Anchor
Fomichev 16 Fomichev 16 FSF 05 FSF 05

[Fomichev 2016] Fomichev, Roman. "Safe Clearing of Private Data". PVS-Studio Team, 2016.

Anchor
FSF 05 FSF 05

[FSF 2005] Free Software Foundation. GCC Online Documentation. 2005.FSF 2005] Free Software Foundation. GCC Online Documentation. 2005.

Anchor
Garfinkel 96 Garfinkel 96

[Garfinkel 1996] Garfinkel, Simson, Simson & Spafford, Gene. Practical UNIX & Internet Security, 2nd ed. Sebastopol, CA: O'Reilly Media, April 1996 (ISBN 1-56592-148-8).

Anchor
GCC Bugs GCC Bugs

[GCC Bugs] GCC Team. GCC Bugs. Free Software Foundation, Inc.

Anchor
GNU 10 GNU 10

[GNU 2010] GNU. Coding Standards. GNU, 2010.

...

Anchor
Goodin 2009 Goodin 2009

[Goodin 2009] Goodin, Dan Goodin. Clever Attack Exploits Fully-Patched Linux Kernel. The Register, July 2009.

Anchor
Gough 2005 Gough 2005

[Gough 2005] Gough, Brian J. An Introduction to GCC. Network Theory Ltd., Revised August 2005 (ISBN 0-9541617-9-3).

Anchor
Graf 03 Graf 03

[Graff 2003] Graff, Mark G. , & Van Wyk, Kenneth R. Secure Coding: Principles and Practices. Cambridge, MA: O'Reilly, 2003 (ISBN 0596002424).

...

Anchor
Griffiths 06 Griffiths 06

[Griffiths 2006] Griffiths, Andrew. Clutching at Straws: When You Can Shift the Stack Pointer. 2006.

Anchor
Gutmann 96 Gutmann 96

[Gutmann 1996] Gutmann, Peter. Secure Deletion of Data from Magnetic and Solid-State Memory. July 1996.

Anchor
Haddad 05 Haddad 05

[Haddad 2005] Haddad, Ibrahim. "Secure Coding in C and C++: An Interview with Robert Seacord, Senior Vulnerability Analyst at CERT." Linux World Magazine, November 2005.

...

Anchor
Henricson 92 Henricson 92

[Henricson 1992] Henricson, Mats , & Nyquist, Erik. Programming in C++, Rules and Recommendations. Ellemtel Telecommunication Systems Laboratories, 1992.

...

Anchor
Howard 02 Howard 02

[Howard 2002] Howard, Michael , & LeBlanc, David C. Writing Secure Code , 2nd ed. Redmond, WA: Microsoft Press, 2002.

Anchor
HP 03 HP 03

[HP 2003] Hewlett-Packard Company. Tru64 UNIX: Protecting Your System against File Name Spoofing Attacks. Houston, TX: Hewlett-Packard Company, January 2003.

Anchor
IEC 60812 2006 IEC 60812 2006

[IEC 60812 2006] IEC (International Electrotechnical Commission). Analysis Techniques for System Reliability—Procedure for Failure Mode and Effects Analysis (FMEA), 2nd ed. (IEC 60812). Geneva, Switzerland: IEC, January 2006.

Anchor
IEC 61508 4 IEC 61508 4

[IEC 61508-4]   IEC. Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems—Part 4: Definitions and Abbreviations. Geneva, Switzerland: IEC, 1998.

Anchor
IEEE 754 2006 IEEE 754 2006

[IEEE 754 2006] IEEE . (Institute of Electrical and Electronics Engineers). Standard for Binary Floating-Point Arithmetic (IEEE 754-1985). New York: IEEE, 2006.

Anchor
IEEE Std 610.12 1990 IEEE Std 610.12 1990

[IEEE Std 610.12 1990] IEEE. IEEE Standard Glossary of Software Engineering Terminology . (1990).

Anchor
IEEE Std 1003.1-2004 IEEE Std 1003.1-2004

[IEEE Std 1003.1, :2004] IEEE and The Open Group. The Open Group Base Specifications Issue 6, (IEEE Std 1003.1), 2004 Edition. (See also ISO/IEC 9945-2004 and #Open Open Group 04.)

Anchor
IEEE Std 1003.1 IEEE Std 1003.1

Anchor
IEEE Std 1003.1-2008 IEEE Std 1003.1-2008

[IEEE Std 1003.1-:2008] IEEE and The Open Group. The Open Group Base Specifications Issue 7, (IEEE Std 1003.1), 2008 Edition. See also ISO/IEC 9945-2008 and #Open Open Group 2008.

Anchor
IEEE Std 610.12 19901003.1-2013 IEEE Std 610.12 19901003.1-2013

[IEEE Std 610.12 19901003.1:2013] IEEE Standard Glossary of Software Engineering Terminologyand The Open Group. Standard for Information Technology—Portable Operating System Interface (POSIX®), Base Specifications, Issue 7 (IEEE Std 1003.1, 2013 Edition). E-book: http://ieeexplore.ieee.org/servlet/opac?punumber=6506089.

Anchor
IETF RFC 6520 IETF RFC 6520

[IETF: RFC 6520] Internet Engineering Task Force (IETF). Request for Comments 6520: Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension. February 2012.

Anchor
IEEE 1003 IEEE 1003

Anchor
ilja 06 ilja 06

 [ilja 2006] ilja. "readlink abuse." ilja's blog. August 13, 2006.

Anchor
Intel 01 Intel 01

[Intel 2001] Intel Corp. _Floating-Point IEEE Filter for Microsoft Windows 2000 on the Intel^® Itanium^© Architecture. March 2001.

Anchor
Internet Society 00 Internet Society 00

[Internet Society 2000] The Internet Society. Internet Security Glossary (RFC 2828). 2000.

Anchor
ISO/IEC 10646-2003 ISO/IEC 10646-2003

Anchor
ISO-IEC 10646-2003 ISO-IEC 10646-2003

[ISO/IEC 10646:2003] ISO/IEC (International Organization for Standardization/International Electrotechnical Commission). Information Technology—Universal Multiple-Octet Coded Character Set (UCS) (ISO/IEC 10646:2003). Geneva, Switzerland: International Organization for Standardization, 2003.

Anchor
ISO/IEC 10646-2012 ISO/IEC 10646-2012

Anchor
ISO-IEC 10646-2012 ISO-IEC 10646-2012

[ISO/IEC 10646:2012] ISO/IEC. Information technology—Universal Multiple-Octet Coded Character Set (UCS) (ISO/IEC 10646:2012). Geneva, Switzerland: ISO, 2012.

Anchor
ISO/IEC 11889-1-2009 ISO/IEC 11889-1-2009

Anchor
ISO-IEC 11889-1-2009 ISO-IEC 11889-1-2009

[ISO/IEC 11889-1:2009] ISO/IEC. Information Technology—Trusted Platform Module—Part 1: Overview (ISO/IEC 11889-1:2009). Geneva, Switzerland: ISO, 2009. September 1990. AnchorIEEE 1003IEEE 1003 Anchorilja 06ilja 06 [ilja 2006] ilja. "readlink abuse." ilja's blog. August 13, 2006. AnchorIntel 01Intel 01 [Intel 2001] Intel Corp. _Floating-Point IEEE Filter for Microsoft* Windows* 2000 on the Intel^® Itanium^© Architecture_. March 2001. AnchorInternet Society 00Internet Society 00 [Internet Society 2000] The Internet Society. Internet Security Glossary (RFC 2828). 2000.

Anchor
ISO/IEC 1064614882-2003 ISO/IEC 1064614882-2003

Anchor
ISO-IEC 1064614882-2003 ISO-IEC 1064614882-2003

[ISO/IEC 1064614882:2003] Information Technology—Universal Multiple-Octet Coded Character Set (UCS) (ISO/IEC. Programming Languages—C++, Second Edition (ISO/IEC 10646:14882-2003). Geneva, Switzerland: International Organization for StandardizationISO, 2003.

Anchor
ISO/IEC 1064614882-20122011 ISO/IEC 1064614882-20122011

Anchor
ISO-IEC 1064614882-20122011 ISO-IEC 1064614882-20122011

[ISO/IEC 10646IEC 14882:2012] Information technology—Universal Multiple-Octet Coded Character Set (UCS) 2011] ISO/IEC. Information Technology—Programming Languages—C++, Third Edition (ISO/IEC 10646:201214882-2011). Geneva, Switzerland: International Organization for Standardization, 2012ISO, 2011.

Anchor
ISO/IEC 1188923360-1-20092006 ISO/IEC 1188923360-1-20092006

Anchor
ISO-IEC 1188923360-1-20092006 ISO-IEC 1188923360-1-20092006

[ISO/IEC 1188923360-1:2009] Information technology—Trusted Platform Module—Part 1: Overview2006] ISO/IEC. Linux Standard Base (LSB) Core Specification 3.1—Part 1: Generic Specification . Geneva, Switzerland: ISO, 2006.

Anchor
ISO/IEC 14882646-20031991 ISO/IEC 14882646-20031991

Anchor
ISO-IEC 14882646-20031991 ISO-IEC 14882646-20031991

[ISO/IEC 14882646:20031991] ISO/IEC. Programming Languages—C++, Second Edition Information Technology: ISO 7-Bit Coded Character Set for Information Interchange (ISO/IEC 14882646-20031991). Geneva, Switzerland: International Organization for Standardization, 2003ISO, 1991.

Anchor
ISO/IEC 14882-20119899:1990 ISO/IEC 14882-20119899:1990

Anchor
ISO-IEC 148829899-20111990 ISO-IEC 148829899-20111990

[ISO/IEC 148829899:20111990] ISO/IEC. Information Technology—Programming Languages—C++, Third Edition Programming Languages—C (ISO/IEC 14882-20119899:1990). Geneva, Switzerland: International Organization for Standardization, 2011ISO, 1990.

Anchor
ISO/IEC 23360-1-20069899:1999 ISO/IEC 23360-1-20069899:1999

Anchor
ISO-IEC 23360-1IEC 9899-20061999 ISO-IEC 233609899-1-20061999

[ISO/IEC 23360-19899:2006] Linux Standard Base (LSB) Core Specification 3.1—Part 1: Generic Specification1999] ISO/IEC. Programming Languages—C, 2nd ed (ISO/IEC 9899:1999). Geneva, Switzerland: International Organization for Standardization, 2006ISO, 1999.

Anchor
ISO/IEC 6469899-19912011 ISO/IEC 6469899-19912011

Anchor
ISO-IEC 6469899-19912011 ISO-IEC 6469899-19912011

[ISO/IEC 6469899:19912011] ISO/IEC. Information Technology: ISO 7-Bit Coded Character Set for Information Interchange Programming Languages—C, 3rd ed (ISO/IEC 646-19919899:2011). Geneva, Switzerland: International Organization for Standardization, 1991ISO, 2011.

Anchor
ISO/IEC 9899:1990-2017 ISO/IEC 9899:1990-2017

Anchor
ISO-IEC 9899-19902017 ISO-IEC 9899-19902017

[ISO/IEC 9899:19902017] ISO/IEC. Programming Languages—C, 4th ed (ISO/IEC 9899:19902017). Geneva, Switzerland: International Organization for Standardization, 1990ISO, 2017.

Anchor
ISO/IEC 9899:1999-2024 ISO/IEC 9899:1999-2024

Anchor
ISO-IEC 9899-19992024 ISO-IEC 9899-19992024

[ISO/IEC 9899:19992024] ISO/IEC. Programming Languages—C, 2nd 5th ed (ISO/IEC 9899:19992024). Geneva, Switzerland: International Organization for Standardization, 1999ISO, 2024.

Anchor
ISO/IEC 98999945-20112003 ISO/IEC 98999945-20112003

Anchor
ISO-IEC 98999945-20112003 ISO-IEC 98999945-20112003

[ISO/IEC 9899:2011] ISO/IEC. Programming Languages—C, 3rd ed IEC 9945:2003] ISO/IEC. Information Technology—Programming Languages, Their Environments and System Software Interfaces—Portable Operating System Interface (POSIX^®) [including Technical Corrigendum 1] (ISO/IEC 98999945:20112003). Geneva, Switzerland: International Organization for Standardization, 2011ISO, 2003.

Anchor
ISO/IEC 9945-2003/IEEE 24765:2010 ISO/IEC 9945-2003/IEEE 24765:2010

Anchor
ISO-/IEC 9945/IEEE 24765-20032010 ISO-/IEC 9945/IEEE 24765-20032010

[ISO/IEC 9945/IEEE 24765:20032010] ISO/IEC 9945:2003 (including Technical Corrigendum 1), Information Technology—Programming Languages, Their Environments and System Software Interfaces—Portable Operating System Interface (POSIX^®/IEEE. Systems and Software Engineering—Vocabulary (ISO/IEC/IEEE 24765:2010). Geneva, Switzerland: International Organization for Standardization, 2003ISO, 2010.

Anchor
ISO/IEC/IEEE 9945-2008 ISO/IEC/IEEE 9945-2008

Anchor
ISO-IEC-IEEE 9945-2008 ISO-IEC-IEEE 9945-2008

[ISO/IEC/IEEE 9945:2008] ISO/IEC 9945:2008 /IEEE. Information Technology—Programming Languages, Their Environments and System Software Interfaces—Portable Operating System Interface (POSIX ^® ). (ISO/IEC/IEEE 9945:2008) Geneva, Switzerland: International Organization for StandardizationISO, 2008.

Anchor
ISO/IEC DTR 24732 ISO/IEC DTR 24732

Anchor
ISO-IEC DTR 24732 ISO-IEC DTR 24732

[ISO/IEC DTR 24732] ISO/IEC JTC1 SC22 WG14 N1290. Extension for the Programming Language C to Support Decimal Floating-Point Arithmetic . Geneva, Switzerland: International Organization for StandardizationISO, March 2008.

Anchor
ISO/IEC JTC1/SC22/WG11 ISO/IEC JTC1/SC22/WG11

Anchor
ISO-IEC JTC1-SC22-WG11 ISO-IEC JTC1-SC22-WG11

[ISO/IEC JTC1/SC22/WG11] ISO/IEC. Binding Techniques (ISO/IEC JTC1/SC22/WG11). Geneva, Switzerland: International Organization for StandardizationISO, 2007.

Anchor
ISO-IEC JTC1-SC22-WG14 ISO-IEC JTC1-SC22-WG14

[ISO/IEC JTC1/SC22/WG14] ISO/IEC. Solving the Struct Hack Problem (ISO/IEC JTC1/SC22/WG14 N791). Geneva, Switzerland: International Organization for StandardizationISO, 1997.

Anchor
ISO/IEC TR 24731-1-2007 ISO/IEC TR 24731-1-2007

Anchor
ISO-IEC TR 24731-1-2007 ISO-IEC TR 24731-1-2007

[ISO/IEC TR 24731-1:2007] ISO/IEC TR 24731. Extensions to the C Library—Part I: Bounds-Checking Interfaces. Geneva, Switzerland: International Organization for StandardizationISO, April 2006.

Anchor
ISO/IEC PDTR 24731-2-2007 ISO/IEC PDTR 24731-2-2007

Anchor
ISO-IEC PDTR 24731-2-2007 ISO-IEC PDTR 24731-2-2007

[ISO/IEC PDTR 24731-2] Extensions to the C Library—Part II: Dynamic Allocation Functions. Geneva, Switzerland: International Organization for StandardizationISO, August 2007.

Anchor
ISO/IEC TR 24731-2-2010 ISO/IEC TR 24731-2-2010

Anchor
ISO-IEC TR 24731-2-2010 ISO-IEC TR 24731-2-2010

[ISO/IEC TR 24731-2:2010] ISO/IEC TR 24731. Extensions to the C Library—Part II: Dynamic Allocation Functions . Geneva, Switzerland: International Organization for StandardizationISO, April 2010.

Anchor
ISO/IEC TR 24772-2010 ISO/IEC TR 24772-2010

Anchor
ISO-IEC TR 24772-2010 ISO-IEC TR 24772-2010

[ISO/IEC TR 24772:2010] ISO/IEC TR 24772:2010. Information Technology— Programming Languages—Guidance to Avoiding Vulnerabilities in Programming Languages through Language Selection and Use, . Geneva, Switzerland: International Organization for StandardizationISO, October 2010.

Anchor
ISO/IEC TR 24772-2013 ISO/IEC TR 24772-2013

Anchor
ISO-IEC TR 24772-2013 ISO-IEC TR 24772-2013

[ISO/IEC TR 24772:2013] ISO/IEC TR 24772:2013. Information Technology—Programming Languages—Guidance to Avoiding Vulnerabilities in Programming Languages through Language Selection and Use.   Geneva, Switzerland: International Organization for StandardizationISO, March 2013.

Anchor
ISO/IEC TS 17961 ISO/IEC TS 17961

Anchor
ISO-IEC TS 17961 ISO/-IEC TS 17961

Anchor
ISO-/IEC TS 17961-2013 ISO-/IEC TS 17961-2013

[ISO/IEC TS 17961] ISO/IEC TS 17961. Information Technology—Programming Languages, Their Environments and System Software Interfaces—C Secure Coding Rules. Geneva, Switzerland: ISO, 2012.

Anchor
ISO/IEC WG14 N1173 ISO/IEC WG14 N1173

Anchor
ISO-IEC WG14 N1173 ISO-IEC WG14 N1173

[ISO/IEC WG14 N1173] ISO/IEC. Rationale for TR 24731 Extensions to the C Library—Part I: Bounds-Checking Interfaces. http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1173.pdf.

Anchor
Jack 07 Jack 07

[Jack 2007] Jack, Barnaby. Vector Rewrite Attack . May 2007.

...

Anchor
Jones 10 Jones 10

[Jones 2010] Jones, Larry. (2010). WG14 N1539 Committee Draft ISO/IEC 9899:201x . http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1539.pdf

Anchor
Juric n.d. Juric n.d.

[Juric n.d.] Juric, Zeljko, et al. (n.d.). TIGCC Documentation, Latest Development Version (TIGCC/TIGCCLIB CVS): C Language Keywords.

Anchor
Keaton 09 Keaton 09

[Keaton 2009] Keaton, David, ; Plum, Thomas, ; Seacord, Robert C., ; Svoboda, David, ; Volkovitsky, Alex, ; & Wilson, Timothy. As-if Infinitely Ranged Integer Model. CMU/SEI-2009-TN-023. July 2009.

...

Anchor
Kernighan 88 Kernighan 88

[Kernighan 1988] Kernighan, Brian W. , & Ritchie, Dennis M. The C Programming Language, 2nd ed. Englewood Cliffs, NJ: Prentice-Hall, 1988.

...

Anchor
Klarer 04 Klarer 04

[Klarer 2004] Klarer, R., ; Maddock, J., ; Dawes, B.; & Hinnant, H. "Proposal to Add Static Assertions to the Core Language (Revision 3)." ISO C++ committee paper ISO/IEC JTC1/SC22/WG21/N1720, October 2004. http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2004/n1720.html.

Anchor
Klein 02 Klein 02

[Klein 2002] Klein, Jack. Bullet Proof Integer Input Using strtol() . 2002.

...

Anchor
Lai 06 Lai 06

[Lai 2006] Lai, Ray. "Reading between the Lines." OpenBSD Journal, October 2006Reading Between the Lines." OpenBSD Journal, October 2006.

Anchor
Lea 2000 Lea 2000

[Lea 2000] Lea, Doug. Concurrent Programming in Java, 2nd ed., Addison-Wesley Professional, Boston, 2000.

Anchor
Lewis 06 Lewis 06

[Lewis 2006] Lewis, Richard. "Security Considerations when Handling Sensitive Data." Posted on the Application Security by Richard Lewis blog October 2006.

...

Anchor
Lipson 06 Lipson 06

[Lipson 2006] Lipson, Howard. Evolutionary Systems Design: Recognizing Changes in Security and Survivability Risks (CMU/SEI-2006-TN-027).  Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2006.

Anchor
Lipson Liu 2009Lipson Liu 2009

[Liu 2009] Likai Liu. Making NULL-pointer reference legal, Life of a Computer Science Student. January, 2009.

Anchor
Lockheed Martin 05 Lockheed Martin 05

[Lockheed Martin 2005] Lockheed Martin. Joint Strike Fighter Air Vehicle C++ Coding Standards for the System Development and Demonstration Program. Document Number 2RDU00001 Rev C., December 2005.

Anchor
Loosemore 07 Loosemore 07

[Loosemore 2007] Loosemore, Sandra, ; Stallman, Richard M., ; McGrath, Roland, ; Oram, Andrew, ; & Drepper, Ulrich. The GNU C Library Reference Manual, Edition 0.11. September 2007.

Anchor
McCluskey 01 McCluskey 01

[McCluskey 2001] Fexible McCluskey, Glen.  Flexible Array Members and Designators in C9X . ;login:, 26, 4 (July 2001): 29–32.

Anchor
Mell 07 Mell 07

[Mell 2007] P. Mell, Peter; Scarfone, K., & Romanosky, SKaren; & Romanesky, Sasha. "A Complete Guide to the Common Vulnerability Scoring System Version 2.0." FIRST, June 2007.

Anchor
mercy 06 mercy 06

[mercyMercy 2006] mercyMercy. Exploiting Uninitialized Data . January 2006.

Anchor
Meyers 2004 Meyers 2004

[Meyers 2004] Meyers, Randy Meyers. Limited size_t WG14 N1080. September 2004.

Anchor
Michael 2004 Michael 2004

[Michael 2004] Michael, M.M. "Hazard Pointers: Safe Memory Reclamation for Lock-Free Objects." IEEE Transactions on Parallel and Distributed Systems, 15, 8 (2004).

...

Anchor
Microsoft 07 Microsoft 07

[Microsoft 2007] Microsoft. C Language Reference, 2007.

...

Anchor
Miller 99 Miller 99

[Miller 1999] Miller, Todd C. , & de Raadt, Theo. strlcpy and strlcat—Consistent, Safe, String Copy and Concatenation. In Proceedings of the FREENIX Track, 1999 USENIX Annual Technical Conference, June 6–11, 1999, Monterey, California, USA. Berkeley, CA: USENIX Association, 1999.

Anchor
Miller 04 Miller 04

[Miller 2004] Miller, Mark C., ; Reus, James F., ; Matzke, Robb P., ; Koziol, Quincey A., ; & Cheng, Albert P. "Smart Libraries: Best SQE Practices for Libraries with an Emphasis on Scientific Computing." In Proceedings of the Nuclear Explosives Code Developer's Conference. Livermore, CA: Lawrence Livermore National Laboratory, December 2004.

...

Anchor
MISRA 12 MISRA 12

[MISRA C:2012] MISRA (Motor Industry Software Reliability Association). MISRA C3: Guidelines for the Use of the C Language in Critical Systems 2012. Nuneaton, UK: MIRA, 2012. ISBN 978-1-906400-10-1.

Anchor
MIT 04 MIT 04

[MIT 2004] MIT (Massachusetts Institute of Technology). "MIT krb5 Security Advisory 2004-002," 2004. http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt. "MIT krb5 Security Advisory 2004-002," 2004.

Anchor
MIT 05 MIT 05

[MIT 2005] MIT. "MIT krb5 Security Advisory 2005-003.http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA- 2005-003-recvauth.txt.

Anchor
MITRE MITRE

[MITRE] MITRE. Common Weakness Enumeration, Version 1.8. February 2010.

...

Anchor
POSIX.1-2004 POSIX.1-2004

Anchor
IEEE Std 1003.1-2004 IEEE Std 1003.1-2004

Anchor
ISO/IEC 9945:2003 ISO/IEC 9945:2003

Anchor
ISO-IEC 9945-2003 ISO-IEC 9945-2003

Anchor
Open Group 04 Open Group 04

[Open Group 2004] The Open Group. The Open Group Base Specifications Issue 6, IEEE Std 1003.1, 2004 Edition . 2004. (See also IEEE Std 1003.1-2004.)

Anchor
POSIX.1-2008 POSIX.1-2008

Anchor
IEEE Std 1003.1-2008 IEEE Std 1003.1-2008

Anchor
ISO/IEC 9945:2008 ISO/IEC 9945:2008

Anchor
ISO-IEC 9945-2003 ISO-IEC 9945-2003

Anchor
Open Group 08 Open Group 08

[Open Group 2008] The Open Group. The Open Group Base Specifications Issue 7, IEEE Std 1003.1, 2008 Edition . 2008. (See also IEEE Std 1003.1-2008.)

Anchor
OpenMP OpenMP

[OpenMP] The OpenMP API^® Specification for Parallel Programming.

...

Anchor
Pethia 03 Pethia 03

[Pethia 2003] Pethia, Richard D. "Viruses and Worms: What Can We Do About Them?" September 10, 2003.

Anchor
Pfaff 04 Pfaff 04

[Pfaff 2004] Pfaff, Ken Thompson. "Casting (time_t)(-1)." Google Groups comps.lang.c, March 2, 2004.

Anchor
Pike 93 Pike 93

[Pike 1993] Pike, Rob & Thompson, Ken. "Hello World." Proceedings of the USENIX Winter 1993 Technical Conference, San Diego, CA, January 25–29, 1993, pp3 43–50.

...

Anchor
Plum 89 Plum 89

[Plum 1989] Plum, Thomas , & Saks, Dan. C Programming Guidelines, 2nd ed. Kamuela, HI: Plum Hall, 1989 (ISBN 0911537074).

...

Anchor
Plum 08 Plum 08

[Plum 2008] Plum, Thomas. "Static Assertions." June 2008. http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1330.pdf

Anchor
Plum 12 Plum 12

[Plum 2012] Plum, Thomas. C Finally Gets a New Standard. Dr. Dobb's, 2012.

Anchor
Redwine 06 Redwine 06

[Redwine 2006] Redwine, Samuel T., Jr., ed. Secure Software Assurance: A Guide to the Common Body of Knowledge to Produce, Acquire, and Sustain Secure Software Version 1.1. U.S. Department of Homeland Security, September 2006. (See Software Assurance Common Body of Knowledge on Build Security In.)

Anchor
Roelker 04 Roelker 04

[Roelker 2004] Roelker, Daniel. "HTTP IDS Evasions Revisited." September 2004.

...

Anchor
Saks 00 Saks 00

[Saks 2000] Saks, Dan. "Numeric Literals ." Embedded Systems Programming, September 2000.

Anchor
Saks 01a Saks 01a

[Saks 2001a] Saks, Dan. "Symbolic Constants ." Embedded Systems Design, November 2001.

Anchor
Saks 01b Saks 01b

[Saks 2001b] Saks, Dan. "Enumeration Constants vs. Constant Objects." Embedded Systems Design, November 2001.

...

Anchor
Saks 08 Saks 08

[Saks 2008] Saks, Dan , & Dewhurst, Stephen C. "Sooner Rather Than Later: Static Programming Techniques for C++" (presentation). March 2008.

Anchor
Saltzer 74 Saltzer 74

[Saltzer 1974] Saltzer, J. H. "Protection and the Control of Information Sharing in Multics." Communications of the ACM 17, 7 (July 1974): 388–402.

Anchor
Saltzer 75 Saltzer 75

[Saltzer 1975] Saltzer, J. H. , & Schroeder, M. D. "The Protection of Information in Computer Systems." Proceedings of the IEEE 63, 9 (September 1975): 1278–1308.

Anchor
Schwarz 05 Schwarz 05

[Schwarz 2005] Schwarz, B., ; Wagner, Hao Chen, ; Morrison, D., ; West, G., ; Lin, J., ; & Tu, J. Wei. "Model Checking an Entire Linux Distribution for Security Violations." Proceedings of the 21st Annual Computer Security Applications Conference, December 2005 (ISSN 1063-9527; ISBN 0-7695-2461-3).

Anchor
Seacord 03 Seacord 03

[Seacord 2003] Seacord, Robert C., ; Plakosh, Daniel, ; & Lewis, Grace A. Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices . Boston: Addison-Wesley, 2003.

Anchor
Seacord 05 Seacord 05

Anchor
Seacord 05a Seacord 05a

Anchor
Seacord 2005a Seacord 2005a

[Seacord 2005a] Seacord, Robert C. Secure Coding in C and C++. Boston: Addison-Wesley, 2005. (See http://www.cert.org/books/secure-coding for news and errata.)

Anchor
Seacord 05b Seacord 05b

[Seacord 2005b] Seacord, Robert C. "Managed String Library for C, C/C++." Users Journal, 23, 10 (October 2005): 30–34.

Anchor
Seacord 05c Seacord 05c

[Seacord 2005c] Seacord, Robert C. "Variadic Functions: How They Contribute to Security Vulnerabilities and How to Fix Them." Linux World Magazine, November 2005.

Anchor
Seacord 2013a Seacord 2013a

[Seacord 2013a] Seacord, Robert C. “C Secure Coding Rules: Past, Present, and Future.” InformIT, June 26, 2013.

Anchor
Seacord 2013 Seacord 2013

Anchor
Seacord 13 Seacord 13

[Seacord 20132013b] Seacord, Robert C. Secure Coding in C and C++. Boston: Addison-Wesley, 2013. (See http://www.cert.org/books/secure-coding for news and errata.)

Anchor
Secunia Secunia

[Secunia] Secunia Advisory SA10635, "HP-UX calloc Buffer Size Miscalculation Vulnerability." 2004.

...

Anchor
Sloss 04 Sloss 04

[Sloss 2004] Sloss, Andrew, ; Symes, Dominic, ; & Wright, Chris. ARM System Developer's Guide . San Francisco: Elsevier/Morgan Kauffman, 2004 (ISBN-10: 1558608745; ISBN-13: 978-1558608740).

...

Anchor
StackOvflw 09 StackOvflw 09

[StackOvflw 2009] StackOverflow.com. "Should I return TRUE / FALSE values from a C function?" StackOverflow.com User Questions, March 15, 2010.

...

Anchor
Summit 05 Summit 05

[Summit 2005] Summit, Steve. comp.lang.c Frequently Asked Questions . 2005.

Anchor
Sun Sun

Anchor
Sun 93 Sun 93

[Sun 1993] Sun Microsystems. Sun Security Bulletin #00122. 1993.

Anchor
Sun 05 Sun 05

[Sun 2005] Sun Microsystems. C User's Guide. 819-3688-10. Sun Microsystems, 2005.

Anchor
Sutter 04 Sutter 04

[Sutter 2004] Sutter, Herb , & Alexandrescu, Andrei. C++ Coding Standards: 101 Rules, Guidelines, and Best Practices. Boston: Addison-Wesley Professional, 2004 (ISBN 0321113586).

Anchor
Tsafrir 08 Tsafrir 08

[Tsafrir 2008] Tsafrir, Dan, ; Da Silva, Dilma, ; & Wagner, David. The Murky Issue of Changing Process Identity: Revising "Setuid Demystified." USENIX, June 2008, pp. 55–66

...

Anchor
van Sprundel06 van Sprundel06

[van Sprundel 2006] van Sprundel, Ilja. Unusualbugs. 2006.

Anchor
Viega 01 Viega 01

[Viega 2001] Viega, John. Protecting Sensitive Data in Memory. February 2001.

Anchor
Viega 03 Viega 03

[Viega 2003] Viega, John , & Messier, Matt. Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Networking, Input Validation & More. Sebastopol, CA: O'Reilly, 2003 (ISBN 0-596-00394-3).

...

Anchor
VU654390 VU654390

[VU#654390] Rafail, Jason A. Vulnerability Note VU#654390, ISC DHCP Contains C Includes That Define vsnprintf() to vsprintf() Creating Potential Buffer Overflow Conditions. June 2004.() to vsprintf() Creating Potential Buffer Overflow Conditions. June 2004.

Anchor
VU720951 VU720951

[VU#720951] Dorman, Will. Vulnerability Note VU#720951, OpenSSL TLS Heartbeat Extension Read Overflow Discloses Sensitive Information. April 2014

Anchor
VU743092 VU743092

[VU#743092] Rafail, Jason A. & Havrilla, Jeffrey S. Vulnerability Note VU#743092, realpath(3) Function Contains Off-by-One Buffer Overflow. July 2003.

...

[VU#881872] Manion, Art & Taschner, Chris. Vulnerability Note VU#881872, Sun Solaris Telnet Authentication Bypass Vulnerability. 2007.

Anchor
VU925211 VU925211

[VU#925211] Dougherty, Chad. Vulnerability Note VU#925211, “Debian and Ubuntu OpenSSL Packages Contain a Predictable Random Number Generator.” June 2008.

Anchor
Walfridsson 03 Walfridsson 03

[Walfridsson 2003] Walfridsson, Krister. Aliasing, Pointer Casts and GCC 3.3. August 2003.

Anchor
Walls 2006 Walls 2006

[Walls 2006] Walls, Douglas.  How to Use the Qualifier in C.  Sun ONE Tools Group, Sun Microsystems. March 2006.

Anchor
Wang 12 Wang 12

[Wang 2012] Wang, Xi. More Randomness or Less . June 2012.

...

Anchor
WG14/N1396 WG14/N1396

[WG14/N1396] Thomas, J. , Tydeman& Tydeman, F. "Wide function return values." September 2009.

...

Anchor
Zalewski 01 Zalewski 01

[Zalewski 2001] Zalewski, Michal. Delivering Signals for Fun and Profit: Understanding, Exploiting and Preventing Signal-Handling Related Vulnerabilities . Bindview Corporation, May 2001.

...

Image Modified