News for hackers. Stuff that matters.

A comment on Software Engineering Institute Makes CERT C++ Coding Standard Freely Available. Parent comment

Re:Software Engineering Institute Makes CERT C++ Coding Stan... by hermitdev on Wednesday March 22, 2017 @07:43PM (#13936167)
I've not read through the CERT C++ rules (yet), but I highly recommend reading "Secure Coding in C and C++" [0]. Expectedly, there's a good discussion on bounds checking. But, nearly half the book is dedicated to integer underflow/overflow (and signed/unsigned) issues (which most devs either ignore or are oblivious to). It's not a panacea, but if you're write C/C++ without thinking about security and how things can go wrong, it can be a real eye opener.

[0] https://www.amazon.com/Secure-Coding-2nd-Software-Engineerin...

[ Parent | on HN ]
Re:Software Engineering Institute Makes CERT C++ Coding Stan... by duneroadrunner on Wednesday March 22, 2017 @08:07PM (#13936334)
I haven't read the book. What's the gist of the recommendations for addressing those issues? SaferCPlusPlus addresses the signed/unsigned issue by providing compatible substitutes[1] for "int" and "size_t" that automatically handle it. And it addresses the integer underflow/overflow issue by recommending another compatible "int" substitute[2] and introducing the concept (but not yet the implementation) of "quarantined" types for untrusted input values.

[1] https://github.com/duneroadrunner/SaferCPlusPlus#cint-csize_...

[2] https://github.com/robertramey/safe_numerics

[ Parent | on HN ]
Re:Software Engineering Institute Makes CERT C++ Coding Stan... by hermitdev on Monday March 27, 2017 @03:54PM (#13971109)
A lot of it involves techniques for detecting that overflow will occur (without actually doing the computation - because in C/C++, once you've signed overflow, you're already into undefined behavior).
[ Parent | on HN ]
Re:Software Engineering Institute Makes CERT C++ Coding Stan... by nickpsecurity on Thursday March 23, 2017 @01:00AM (#13937493)
Just found slides of the integer stuff, too, for anyone without the book.

http://www.sis.pitt.edu/jjoshi/courses/IS2620/Spring07/Lectu...

[ Parent | on HN ]