CERT C Programming Language Secure Coding Standard

Navigation Maps

Input Rules and Recommendations
FIO02-C. Canonicalize path names originating from tainted sources	FIO13-C. Never push back anything other than one read character	FIO20-C. Avoid unintentional truncation when using fgets() or fgetws()	FIO30-C. Exclude user input from format strings	FIO37-C. Do not assume that fgets() or fgetws() returns a nonempty string when successful
FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call	FIO40-C. Reset strings on fgets() or fgetws() failure	INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs

Characters Rules and Recommendations
FIO41-C. Do not call getc(), putc(), getwc(), or putwc() with a stream argument that has side effects	INT07-C. Use only explicitly signed or unsigned char type for numeric values	MSC09-C. Character encoding: Use subset of ASCII for safety	MSC10-C. Character encoding: UTF8-related issues

Conversion Rules and Recommendations
DCL31-C. Declare identifiers before using them	EXP36-C. Do not cast pointers into more strictly aligned pointer types	INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size	INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data	INT36-C. Converting a pointer to integer or integer to pointer
Rec. 04. Integers (INT)	Rule 04. Integers (INT)