BB. Definitions

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="24c521e4-748c-4406-8158-58ecd052d1b4"><ac:parameter ac:name=""> asynchronous-safe</ac:parameter></ac:structured-macro>
asynchronous-safe [[GNU Pth]]
A function is asynchronous-safe, or asynchronous-signal safe, if it can be called safely and without side effects from within a signal handler context. That is, it must be able to be interrupted at any point and run linearly out of sequence without causing an inconsistent state. Some asynchronous-safe operations are listed below:

• call the signal() function to reinstall a signal handler
• unconditionally modify a volatile sig_atomic_t variable (as modification to this type is atomic)
• call the _Exit() function to immediately terminate program execution
• invoke an asynchronous-safe function, as specified by your implementation

Few functions are asynchronous-safe. If a function performs any other operations, it is probably not asynchronous-safe.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="f3d50cd5-9ab4-46a3-8234-cd103b38abdb"><ac:parameter ac:name=""> exploit</ac:parameter></ac:structured-macro>
exploit [[Seacord 05]]
An exploit is a piece of software or technique that takes advantage of a security vulnerability to violate an explicit or implicit security policy.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="817e30bc-4d31-434f-a202-43202a84d1f5"><ac:parameter ac:name=""> freestanding environment</ac:parameter></ac:structured-macro>
freestanding environment [[ISO/IEC 9899-1999]]
An environment in which C program execution may take place without any benefit of an operating system.  Program startup might occur at some function other than main(), complex types might not be implemented, and only certain minimal library facilities are guaranteed to be available.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="8af65231-376c-421b-a403-cdd1f91d22ea"><ac:parameter ac:name=""> hosted environment</ac:parameter></ac:structured-macro>
hosted environment [[ISO/IEC 9899-1999]]
An environment that is not freestanding.  Program startup occurs at main(), complex types are implemented, and all C standard library facilities are available.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="181eb4f4-ee66-49f9-af8a-b8a21937c1b8"><ac:parameter ac:name=""> implementation</ac:parameter></ac:structured-macro>
implementation [[ISO/IEC 9899-1999]]
Particular set of software, running in a particular translation environment under particular control options, that performs translation of programs for, and supports execution of functions in, a particular execution environment.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="6e05e190-4eef-4888-b9ec-10cdfe3c07d9"><ac:parameter ac:name=""> implementation-defined behavior</ac:parameter></ac:structured-macro>
implementation-defined behavior [[ISO/IEC 9899-1999]]
Unspecified behavior where each implementation documents how the choice is made.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="3548a388-004e-4d62-b35a-86d8d0ad1480"><ac:parameter ac:name=""> locale-specific behavior</ac:parameter></ac:structured-macro>
locale-specific behavior [[ISO/IEC 9899-1999]]
Behavior that depends on local conventions of nationality, culture, and language that each implementation documents.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="2e7c500b-2daf-4cf5-b35a-0370bd4bec8a"><ac:parameter ac:name=""> lvalue</ac:parameter></ac:structured-macro>
lvalue [[ISO/IEC 9899-1999]]
An lvalue is an expression with an object type or an incomplete type other than void. The name "lvalue" comes originally from the assignment expression E1 = E2, in which the left operand E1 is required to be a (modifiable) lvalue. It is perhaps better considered as representing an object "locator value".

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="10495750-1693-4fc7-8b69-4a1cc3fbeae3"><ac:parameter ac:name=""> mitigation</ac:parameter></ac:structured-macro>
mitigation [[Seacord 05]]
Mitigations are methods, techniques, processes, tools, or runtime libraries that can prevent or limit exploits against vulnerabilities.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="47afe0fd-1cfa-487b-95ec-b3cef818aba4"><ac:parameter ac:name=""> reentrant</ac:parameter></ac:structured-macro>
reentrant [[Dowd 06]]
A function is reentrant if multiple instances of the same function can run in the same address space concurrently without creating the potential for inconsistent states.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="dc8a3e03-040a-4e7e-967e-318b4c2f3c92"><ac:parameter ac:name=""> rvalue</ac:parameter></ac:structured-macro>
rvalue [[ISO/IEC 9899-1999]]
Value of an expression.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="e4ee5c1b-3365-486f-b98c-d5ca0438c2c2"><ac:parameter ac:name=""> security flaw</ac:parameter></ac:structured-macro>
security flaw [[Seacord 05]]
A security flaw is a software defect that poses a potential security risk.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="b42bf99e-9fba-4b77-94b4-ddacd7f28d8e"><ac:parameter ac:name=""> security policy</ac:parameter></ac:structured-macro>
security policy [[Internet Society 00]]
A set of rules and practices that specify or regulate how a system or organization
provides security services to protect sensitive and critical system resources.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="4eae23ef-468a-43cd-9af8-ca7fd048f03a"><ac:parameter ac:name=""> undefined behavior</ac:parameter></ac:structured-macro>
undefined behavior [[ISO/IEC 9899-1999]]
Behavior, upon use of a nonportable or erroneous program construct or of erroneous data, for which the standard imposes no requirements. An example of undefined behavior is the behavior on integer overflow.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="fc71e569-b956-4409-abe0-29d2cd00eedd"><ac:parameter ac:name=""> unspecified behavior</ac:parameter></ac:structured-macro>
unspecified behavior [[ISO/IEC 9899-1999]]
Behavior where the standard provides two or more possibilities and imposes no further requirements on which is chosen in any instance.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="d111a8da-113e-464b-987b-c3f833bd0176"><ac:parameter ac:name=""> validation</ac:parameter></ac:structured-macro>
validation [[IEC 61508-4]]
Confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use are fulfilled.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="5fe1b9e3-c28f-4e3b-9145-ee6003aecc61"><ac:parameter ac:name=""> verification</ac:parameter></ac:structured-macro>
verification [[IEC 61508-4]]
Confirmation by examination and provision of objective evidence that the requirements have been fulfilled.

<ac:structured-macro ac:name="anchor" ac:schema-version="1" ac:macro-id="c4e535bb-e484-4396-9ca1-7385711d49ad"><ac:parameter ac:name=""> verification</ac:parameter></ac:structured-macro>
vulnerability [[Seacord 05]]
A vulnerability is a set of conditions that allows an attacker to violate an explicit or implicit security policy.