CERT C Programming Language Secure Coding Standard


We have made significant progress on the CERT C Programming Language
Secure Coding Standard since I first posted about this effort around a
year ago. In particular, the document was reviewed and endorsed by the
WG14 C language standards committee at the London meeting in April of
this year.

We would again like to invite the community to review and comment on the
current version of the standard available at www.securecoding.cert.org
before we publish the final version. To do this, you can create an
account on the secure coding wiki and post your comments there.

There is some possibility that ISO/IEC WG14 may eventually publish this
document as a type III (informational) technical report and this
document may also be mined for ideas for the next major revision of the
C language standard. As a result, we would greatly appreciate your time
and expertise in reviewing the standard, and we will acknowledge your
contributions.

Thanks,
rCs
.

Relevant Pages

  • Re: Is C99 the final C? (some suggestions)
    ... > that someone will try compile their stuff on an old compiler. ... > because the ANSI standard obsoleted them, and everyone picked up the ANSI ... fixed by using another language. ... >>are multiplying two expressions of the widest type supported by your ...
    (comp.lang.c)
  • Re: subroutine stack and C machine model
    ... They could have standardized that the language would be ... getting the facts wrong anyway. ... And the answer, for the Schildt books, is that they consistently produced ... to C start with the standard. ...
    (comp.lang.c)
  • Re: Two Questions about "strlen", "strcat" and "strcpy"
    ... >> No. zero terminated strings is the whole problem in the first place. ... > OR length prefixed strings the language would retain compatibility ... is not easily duplicated with the old standard then it will foster interest. ... The C standards committee is dead. ...
    (comp.lang.c)
  • Re: Forth Frustrations
    ... How would they even know what they are without being language lawyers? ... standard systems and a large number of nonstandard ones. ... interpreter, ... They set up four states -- HOST INTERPRETER COMPILER ...
    (comp.lang.forth)
  • Re: Is C99 the final C? (some suggestions)
    ... >> because the ANSI standard obsoleted them, and everyone picked up the ANSI ... > fixed by using another language. ... programmers managing the meaning of the symbols for more generic operators. ... According to a paper by Intel, widening multiply accounts for something like ...
    (comp.lang.c)