Unsafe C Functions: Secure Coding Strategies for Modern C and C++

Static analysis tools like clang-tidy, cppcheck, and include-what-you-use can be integrated into CMake using target properties. For clang-tidy, set target_compile_commands or target_compile_options. These tools run for each compilation unit and can be configured with flags. They are initialized with variables prefixed with CMAKE_ (e.g., CMAKE_CXX_CLANG_TIDY).

CTest integrates static analysis through target properties: CLANG_TIDY, Cppcheck, CppLint, MISRA, and INCLUDE_WHAT_YOU_USE, all settable in build pipelines. Clazy (KDE's Clang plugin) appears as normal compiler warnings and can be individually disabled. Test launchers (compiler_launcher, linker_launcher, test_launcher) enable instrumentation by prefixing commands with custom scripts for caching, static analysis, or diagnostics. These launchers capture detailed diagnostics including target names, source files, command lines, stdout/stderr, and exit codes, enabling comprehensive build analysis.

Static analysis examines programs before execution to detect potential issues across all possible paths, while dynamic analysis runs programs with actual inputs to observe behavior. Static analysis must be conservative due to unknown runtime inputs, while dynamic analysis provides concrete evidence of bugs but misses untested scenarios. Fortified standard libraries add safety checks to catch out-of-bounds accesses and null dereferences during development builds. The Guideline Support Library (GSL) implements safety features from C++ core guidelines. Compiler warnings with -Werror catch numerous common bugs. Clang-Tidy integrates into build systems to check code against modern best practices. These complementary approaches—static and dynamic analysis—provide layered safety verification, catching errors at different stages of the development process.

Integrating static analysis tools like clang-tidy into code review systems requires careful integration with the project's build system. Most of the work involved in setting up such integrations involves configuring how the analysis tool communicates with the build system to understand how to compile source code correctly. Once properly integrated, these tools can automatically check code quality during pull requests and flag potential issues before code merges. The clang-tidy documentation provides extensive guidance on integrating with various build systems, making it possible to incorporate these powerful analysis capabilities into existing development workflows.

Static and dynamic analysis tools complement each other effectively. Static analysis (like Clang-Tidy) is useful before compilation, catching issues without building the project. Dynamic analysis (like sanitizers and Valgrind) is useful after compilation, catching runtime issues that only appear during execution. Using both approaches together provides comprehensive code quality assurance, as each method catches different types of bugs.

The CERT C Secure Coding Standard provides guidelines for secure C programming, with preprocessor rules (PRE30-C through PRE13-C) covering critical practices such as avoiding token concatenation with Unicode characters, preventing side effects in macro arguments, using parentheses around macro parameters, implementing include guards, avoiding trigraph sequences, and understanding the distinction between name-based and value-based semantics in macros to prevent subtle security vulnerabilities.

The CERT C++ Secure Coding Standard, developed by Carnegie Mellon University's Software Engineering Institute, establishes community-based rules and recommendations to prevent common programming errors that lead to software vulnerabilities. The standard distinguishes between rules (specific requirements that can be automatically verified to prevent exploits) and recommendations (general best practices). Static analysis tools, which examine source code rather than compiled binaries, are essential for identifying security issues because they can analyze all code paths completely and catch problems that dynamic analysis might miss. Modern C++ features like template meta-programming enable compile-time safety checks that can improve both correctness and performance while eliminating runtime vulnerabilities.

Multiple C++ guideline ecosystems serve different purposes: (1) C++ Core Guidelines - evolving community-driven guidelines promoting modern C++ practices; (2) MISRA C++ - established safety-critical guidelines from automotive sector (2008 version), though considered outdated for modern C++; (3) SEI CERT C++ Coding Standard - another industry-standard guideline; (4) AUTOSAR - automotive industry guidelines addressing limitations of MISRA for modern self-driving cars. Modern C++ philosophy emphasizes eliminating undefined behavior while maintaining efficiency through: (1) Standard library algorithms over custom loops; (2) RAII for resource management; (3) Smart pointers over raw pointers; (4) Const correctness; (5) Rule of Zero letting compiler generate special member functions. Effective tooling with immediate feedback during editing is essential for learning and adoption.

CERT employs a three-metric risk assessment framework for prioritizing security rules: Severity (Level 1: program crash/hang; Level 2: information exfiltration; Level 3: arbitrary code execution), Probability (Unlikely, Probable, Likely), and Fix Difficulty (Easy to Hard). Multiplying these values produces priority scores from 1-27, enabling rational triage decisions. This framework maps directly to the CIA Triad—availability corresponds to Level 1, confidentiality/integrity to Level 2, and Level 3 compromises all three simultaneously. Multiple secure coding standards exist for different application domains: MISRA for automotive safety, JSF for military systems, High Integrity C++ for safety-critical applications, Linux kernel standards, and proprietary standards. Surveys indicate approximately 40% of organizations use proprietary standards, often evolving from style guides before incorporating security requirements. Many safety standards ensure software won't harm users but don't address attacker exploitation, necessitating separate security standards alongside safety standards.

Hardcoded credentials (passwords, API keys) in source code are a critical vulnerability - attackers can extract them and gain privileged access. Instead, secrets should be stored in environment variables or configuration files with restricted access. Secure coding standards include: CWE (Common Weakness Enumeration), CERT C++ Coding Standard, MISRA C++ (for automotive), and OWASP Top 10. These provide guidelines for writing secure code.

Stack canaries include terminator canaries (null bytes/line feeds that stop string operations) and random canaries (unpredictable values). GCC implements stack protection through -fstack-protector (terminator canaries) and -fstack-protector-all (enabling all functions). Visual Studio implements /GS security cookies since 2003, XORing with EBP/RBP for added entropy. Canaries can be bypassed through leak-and-reuse attacks (format strings to disclose values), brute force (16 million possibilities on 32-bit systems), and byte-by-byte guessing. Null bytes can be injected through secondary buffers. These bypasses exist, but canaries remain valuable defense-in-depth mechanisms.

Modern operating systems employ multiple complementary defenses against buffer overflow exploits. Address Space Layout Randomization (ASLR) randomizes memory addresses, preventing attackers from predicting where injected code resides. Data Execution Prevention (DEP/NX bit) marks data regions as non-executable, preventing execution of injected code even if it reaches memory. Stack canaries place random values before return addresses, detecting buffer overflows before exploitation completes. These defenses were implemented after the Heartbleed vulnerability exposed critical weaknesses in cryptographic libraries. The fundamental challenge is that no defense is perfect—sophisticated attackers continue developing bypass techniques, requiring continuous evolution of security mechanisms.

This section examines the layered defense mechanisms modern operating systems employ against buffer overflow exploits. Non-executable stack (NX) marks stack memory as non-executable, preventing injected shellcode from running. Address Space Layout Randomization (ASLR) randomizes memory addresses, making it harder for attackers to predict where to jump. Stack canaries place random values between buffers and return addresses, detecting overflows before exploitation. Return-Libc (ret2libc) is presented as an alternative exploitation technique that doesn't inject code but redirects execution to existing library functions like system(), using predictable library addresses. Each mechanism has limitations: NX can be disabled by administrators, ASLR is easier to bypass on 32-bit systems, and canaries add code overhead. Together, these mechanisms form a defense-in-depth strategy that significantly raises the bar for successful exploitation.

Windows implements multiple memory protection mechanisms to defend against software exploits. Control Flow Guard (CFG) prevents execution redirection by validating indirect call targets. Data Execution Prevention (DEP) blocks code execution from non-executable memory regions. Address Space Layout Randomization (ASLR) randomizes memory addresses at runtime, with Mandatory ASLR forcing this on all programs regardless of compilation settings. Bottom-up ASLR randomizes runtime memory allocation starting points, while High Entropy ASLR expands address space from 4GB to hundreds of terabytes for 64-bit apps. SEHOP protects exception handling chains from tampering, and Heap Integrity Validation terminates processes on detected heap corruption. Together, these mechanisms create layered defenses that make exploitation significantly more difficult for attackers.

Modern binaries include several security protections: Stack Protector (stack smashing detection), NX (No-eXecute/DEP - prevents execution of stack memory), PIE (Position Independent Executable - randomizes address space), and ASLR (Address Space Layout Randomization). These protections make exploitation more difficult by preventing predictable memory addresses and protecting critical areas from modification.

API design is the first line of defense against misuse. Key principles include: (1) Limiting API surface area - a good hammer isn't a good screwdriver; (2) Making classes final by default since inheritance should be designed for; (3) Controlling visibility - Java defaults to package-private while Kotlin defaults to public, so private should be the default; (4) Introducing factories as convenient, semantically meaningful replacements for constructors that provide more flexibility in construction and allow returning subclasses or different implementations.

The fundamental principle is that you cannot misuse what cannot be misused. Key practices include: limiting API surface area by making classes final by default, using private visibility as the default, and using factories instead of direct constructors. When working with user-provided code, communicate only through interfaces rather than implementation details to keep code honest and provide maximum flexibility. The key question is how easy it is to do the wrong thing and whether this design will limit future flexibility.

Effective library API design requires: (1) A top-level API that acts as a reference point, providing methods like 'SWS.new sandwich' that return appropriate objects without exposing internal class structures; (2) This approach decouples clients from internal implementation, provides flexibility to change internals without breaking backwards compatibility, and gives clients a clear list of what they should interact with; (3) Treat error API design as equally important as the main API, as it significantly impacts how users interact with your library.

Key software design principles emerge from security evolution: (1) The path of least astonishment—APIs should behave as users expect, avoiding counterintuitive patterns; (2) Code example contamination—bad examples proliferate when developers copy without understanding, requiring deliberate cleanup; (3) Security costs extend beyond computation to include cognitive burden on contributors; (4) Make it easy to do the right thing and hard to do the wrong thing through thoughtful API design; (5) Regularly review and simplify APIs that have become unnecessarily complex over time.

Secure API design requires avoiding predictable endpoint names (API v1, departments, client IDs) that attackers can easily guess. Proper data validation prevents fuzzing attacks by rejecting unexpected inputs and boundary values. APIs should return only data necessary for specific use cases rather than exposing complete datasets. Using relative data (based on starting positions) instead of absolute values makes exploitation harder. Defensive programming assumes all inputs could be malicious, requiring validation of all parameters and treating requests as orders rather than assumptions.