Sections

• Page:
  Rec. 01. Preprocessor (PRE)
• Page:
  Rec. 02. Declarations and Initialization (DCL)
• Page:
  Rec. 03. Expressions (EXP)
• Page:
  Rec. 04. Integers (INT)
• Page:
  Rec. 05. Floating Point (FLP)
• Page:
  Rec. 06. Arrays (ARR)
• Page:
  Rec. 07. Characters and Strings (STR)
• Page:
  Rec. 08. Memory Management (MEM)
• Page:
  Rec. 09. Input Output (FIO)
• Page:
  Rec. 10. Environment (ENV)
• Page:
  Rec. 11. Signals (SIG)
• Page:
  Rec. 12. Error Handling (ERR)
• Page:
  Rec. 13. Application Programming Interfaces (API)
• Page:
  Rec. 14. Concurrency (CON)
• Page:
  Rec. 48. Miscellaneous (MSC)
• Page:
  Rec. 50. POSIX (POS)
• Page:
  Rec. 51. Microsoft Windows (WIN)

Recommendation Listing

• Page:
  API00-C. Functions should validate their parameters
• Page:
  API01-C. Avoid laying out strings in memory directly before sensitive data
• Page:
  API02-C. Functions that read or write to or from an array should take an argument to specify the source or target size
• Page:
  API03-C. Create consistent interfaces and capabilities across related functions
• Page:
  API04-C. Provide a consistent and usable error-checking mechanism
• Page:
  API05-C. Use conformant array parameters
• Page:
  API07-C. Enforce type safety
• Page:
  API09-C. Compatible values should have the same type
• Page:
  API10-C. APIs should have security options enabled by default
• Page:
  ARR00-C. Understand how arrays work
• Page:
  ARR01-C. Do not apply the sizeof operator to a pointer when taking the size of an array
• Page:
  ARR02-C. Explicitly specify array bounds, even if implicitly defined by an initializer
• Page:
  CON01-C. Acquire and release synchronization primitives in the same module, at the same level of abstraction
• Page:
  CON02-C. Do not use volatile as a synchronization primitive
• Page:
  CON03-C. Ensure visibility when accessing shared variables
• Page:
  CON04-C. Join or detach threads even if their exit status is unimportant
• Page:
  CON05-C. Do not perform operations that can block while holding a lock
• Page:
  CON06-C. Ensure that every mutex outlives the data it protects
• Page:
  CON07-C. Ensure that compound operations on shared variables are atomic
• Page:
  CON08-C. Do not assume that a group of calls to independently atomic methods is atomic
• Page:
  CON09-C. Avoid the ABA problem when using lock-free algorithms
• Page:
  DCL00-C. Const-qualify immutable objects
• Page:
  DCL01-C. Do not reuse variable names in subscopes
• Page:
  DCL02-C. Use visually distinct identifiers
• Page:
  DCL03-C. Use a static assertion to test the value of a constant expression
• Page:
  DCL04-C. Do not declare more than one variable per declaration
• Page:
  DCL05-C. Use typedefs of non-pointer types only
• Page:
  DCL06-C. Use meaningful symbolic constants to represent literal values
• Page:
  DCL07-C. Include the appropriate type information in function declarators
• Page:
  DCL08-C. Properly encode relationships in constant definitions
• Page:
  DCL09-C. Declare functions that return errno with a return type of errno_t
• Page:
  DCL10-C. Maintain the contract between the writer and caller of variadic functions
• Page:
  DCL11-C. Understand the type issues associated with variadic functions
• Page:
  DCL12-C. Implement abstract data types using opaque types
• Page:
  DCL13-C. Declare function parameters that are pointers to values not changed by the function as const
• Page:
  DCL15-C. Declare file-scope objects or functions that do not need external linkage as static
• Page:
  DCL16-C. Use "L," not "l," to indicate a long value
• Page:
  DCL17-C. Beware of miscompiled volatile-qualified variables
• Page:
  DCL18-C. Do not begin integer constants with 0 when specifying a decimal value
• Page:
  DCL19-C. Minimize the scope of variables and functions
• Page:
  DCL20-C. Explicitly specify void when a function accepts no arguments
• Page:
  DCL21-C. Understand the storage of compound literals
• Page:
  DCL22-C. Use volatile for data that cannot be cached
• Page:
  DCL23-C. Guarantee that mutually visible identifiers are unique
• Page:
  ENV01-C. Do not make assumptions about the size of an environment variable
• Page:
  ENV02-C. Beware of multiple environment variables with the same effective name
• Page:
  ENV03-C. Sanitize the environment when invoking external programs
• Page:
  ERR00-C. Adopt and implement a consistent and comprehensive error-handling policy
• Page:
  ERR01-C. Use ferror() rather than errno to check for FILE stream errors
• Page:
  ERR02-C. Avoid in-band error indicators
• Page:
  ERR03-C. Use runtime-constraint handlers when calling the bounds-checking interfaces
• Page:
  ERR04-C. Choose an appropriate termination strategy
• Page:
  ERR05-C. Application-independent code should provide error detection without dictating error handling
• Page:
  ERR06-C. Understand the termination behavior of assert() and abort()
• Page:
  ERR07-C. Prefer functions that support error checking over equivalent functions that don't
• Page:
  EXP00-C. Use parentheses for precedence of operation
• Page:
  EXP02-C. Be aware of the short-circuit behavior of the logical AND and OR operators
• Page:
  EXP03-C. Do not assume the size of a structure is the sum of the sizes of its members
• Page:
  EXP05-C. Do not cast away a const qualification
• Page:
  EXP07-C. Do not diminish the benefits of constants by assuming their values in expressions
• Page:
  EXP08-C. Ensure pointer arithmetic is used correctly
• Page:
  EXP09-C. Use sizeof to determine the size of a type or variable
• Page:
  EXP10-C. Do not depend on the order of evaluation of subexpressions or the order in which side effects take place
• Page:
  EXP11-C. Do not make assumptions regarding the layout of structures with bit-fields
• Page:
  EXP12-C. Do not ignore values returned by functions
• Page:
  EXP13-C. Treat relational and equality operators as if they were nonassociative
• Page:
  EXP14-C. Beware of integer promotion when performing bitwise operations on integer types smaller than int
• Page:
  EXP15-C. Do not place a semicolon on the same line as an if, for, or while statement
• Page:
  EXP16-C. Do not compare function pointers to constant values
• Page:
  EXP19-C. Use braces for the body of an if, for, or while statement
• Page:
  EXP20-C. Perform explicit tests to determine success, true and false, and equality
• Page:
  FIO01-C. Be careful using functions that use file names for identification
• Page:
  FIO02-C. Canonicalize path names originating from tainted sources
• Page:
  FIO03-C. Do not make assumptions about fopen() and file creation
• Page:
  FIO05-C. Identify files using multiple file attributes
• Page:
  FIO06-C. Create files with appropriate access permissions
• Page:
  FIO08-C. Take care when calling remove() on an open file
• Page:
  FIO09-C. Be careful with binary data when transferring data across systems
• Page:
  FIO10-C. Take care when using the rename() function
• Page:
  FIO11-C. Take care when specifying the mode parameter of fopen()
• Page:
  FIO13-C. Never push back anything other than one read character
• Page:
  FIO14-C. Understand the difference between text mode and binary mode with file streams
• Page:
  FIO15-C. Ensure that file operations are performed in a secure directory
• Page:
  FIO17-C. Do not rely on an ending null character when using fread()
• Page:
  FIO18-C. Never expect fwrite() to terminate the writing process at a null character
• Page:
  FIO19-C. Do not use fseek() and ftell() to compute the size of a regular file
• Page:
  FIO20-C. Avoid unintentional truncation when using fgets() or fgetws()
• Page:
  FIO21-C. Do not create temporary files in shared directories
• Page:
  FIO22-C. Close files before spawning processes
• Page:
  FIO23-C. Do not exit with unflushed data in stdout or stderr
• Page:
  FIO24-C. Do not open a file that is already open
• Page:
  FLP00-C. Understand the limitations of floating-point numbers
• Page:
  FLP01-C. Take care in rearranging floating-point expressions
• Page:
  FLP02-C. Avoid using floating-point numbers when precise computation is needed
• Page:
  FLP03-C. Detect and handle floating-point errors
• Page:
  FLP04-C. Check floating-point inputs for exceptional values
• Page:
  FLP05-C. Do not use denormalized numbers
• Page:
  FLP06-C. Convert integers to floating point for floating-point operations
• Page:
  FLP07-C. Cast the return value of a function that returns a floating-point type
• Page:
  INT00-C. Understand the data model used by your implementation(s)
• Page:
  INT01-C. Use rsize_t or size_t for all integer values representing the size of an object
• Page:
  INT02-C. Understand integer conversion rules
• Page:
  INT04-C. Enforce limits on integer values originating from tainted sources
• Page:
  INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs
• Page:
  INT07-C. Use only explicitly signed or unsigned char type for numeric values
• Page:
  INT08-C. Verify that all integer values are in range
• Page:
  INT09-C. Ensure enumeration constants map to unique values
• Page:
  INT10-C. Do not assume a positive remainder when using the % operator
• Page:
  INT12-C. Do not make assumptions about the type of a plain int bit-field when used in an expression
• Page:
  INT13-C. Use bitwise operators only on unsigned operands
• Page:
  INT14-C. Avoid performing bitwise and arithmetic operations on the same data
• Page:
  INT15-C. Use intmax_t or uintmax_t for formatted IO on programmer-defined integer types
• Page:
  INT16-C. Do not make assumptions about representation of signed integers
• Page:
  INT17-C. Define integer constants in an implementation-independent manner
• Page:
  INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size
• Page:
  MEM00-C. Allocate and free memory in the same module, at the same level of abstraction
• Page:
  MEM01-C. Store a new value in pointers immediately after free()
• Page:
  MEM02-C. Immediately cast the result of a memory allocation function call into a pointer to the allocated type
• Page:
  MEM03-C. Clear sensitive information stored in reusable resources
• Page:
  MEM04-C. Beware of zero-length allocations
• Page:
  MEM05-C. Avoid large stack allocations
• Page:
  MEM06-C. Ensure that sensitive data is not written out to disk
• Page:
  MEM07-C. Ensure that the arguments to calloc(), when multiplied, do not wrap
• Page:
  MEM10-C. Define and use a pointer validation function
• Page:
  MEM11-C. Do not assume infinite heap space
• Page:
  MEM12-C. Consider using a goto chain when leaving a function on error when using and releasing resources
• Page:
  MSC00-C. Compile cleanly at high warning levels
• Page:
  MSC01-C. Strive for logical completeness
• Page:
  MSC04-C. Use comments consistently and in a readable fashion
• Page:
  MSC05-C. Do not manipulate time_t typed values directly
• Page:
  MSC06-C. Beware of compiler optimizations
• Page:
  MSC07-C. Detect and remove dead code
• Page:
  MSC09-C. Character encoding: Use subset of ASCII for safety
• Page:
  MSC10-C. Character encoding: UTF8-related issues
• Page:
  MSC11-C. Incorporate diagnostic tests using assertions
• Page:
  MSC12-C. Detect and remove code that has no effect or is never executed
• Page:
  MSC13-C. Detect and remove unused values
• Page:
  MSC14-C. Do not introduce unnecessary platform dependencies
• Page:
  MSC15-C. Do not depend on undefined behavior
• Page:
  MSC17-C. Finish every set of statements associated with a case label with a break statement
• Page:
  MSC18-C. Be careful while handling sensitive data, such as passwords, in program code
• Page:
  MSC19-C. For functions that return an array, prefer returning an empty array over a null value
• Page:
  MSC20-C. Do not use a switch statement to transfer control into a complex block
• Page:
  MSC21-C. Use robust loop termination conditions
• Page:
  MSC22-C. Use the setjmp(), longjmp() facility securely
• Page:
  MSC23-C. Beware of vendor-specific library and language differences
• Page:
  MSC24-C. Do not use deprecated or obsolescent functions
• Page:
  MSC25-C. Do not use insecure or weak cryptographic algorithms
• Page:
  POS01-C. Check for the existence of links when dealing with files
• Page:
  POS02-C. Follow the principle of least privilege
• Page:
  POS04-C. Avoid using PTHREAD_MUTEX_NORMAL type mutex locks
• Page:
  POS05-C. Limit access to files by creating a jail
• Page:
  PRE00-C. Prefer inline or static functions to function-like macros
• Page:
  PRE01-C. Use parentheses within macros around parameter names
• Page:
  PRE02-C. Macro replacement lists should be parenthesized
• Page:
  PRE04-C. Do not reuse a standard header file name
• Page:
  PRE05-C. Understand macro replacement when concatenating tokens or performing stringification
• Page:
  PRE06-C. Enclose header files in an include guard
• Page:
  PRE07-C. Avoid using repeated question marks
• Page:
  PRE08-C. Guarantee that header file names are unique
• Page:
  PRE09-C. Do not replace secure functions with deprecated or obsolescent functions
• Page:
  PRE10-C. Wrap multistatement macros in a do-while loop
• Page:
  PRE11-C. Do not conclude macro definitions with a semicolon
• Page:
  PRE12-C. Do not define unsafe macros
• Page:
  PRE13-C. Use the Standard predefined macros to test for versions and features.
• Page:
  Rules versus Recommendations
• Page:
  SIG00-C. Mask signals handled by noninterruptible signal handlers
• Page:
  SIG01-C. Understand implementation-specific details regarding signal handler persistence
• Page:
  SIG02-C. Avoid using signals to implement normal functionality
• Page:
  STR00-C. Represent characters using an appropriate type
• Page:
  STR01-C. Adopt and implement a consistent plan for managing strings
• Page:
  STR02-C. Sanitize data passed to complex subsystems
• Page:
  STR03-C. Do not inadvertently truncate a string
• Page:
  STR04-C. Use plain char for characters in the basic character set
• Page:
  STR05-C. Use pointers to const when referring to string literals
• Page:
  STR06-C. Do not assume that strtok() leaves the parse string unchanged
• Page:
  STR07-C. Use the bounds-checking interfaces for string manipulation
• Page:
  STR08-C. Use managed strings for development of new string manipulation code
• Page:
  STR09-C. Don't assume numeric values for expressions with type plain character
• Page:
  STR10-C. Do not concatenate different type of string literals
• Page:
  STR11-C. Do not specify the bound of a character array initialized with a string literal
• Page:
  WIN00-C. Be specific when dynamically loading libraries
• Page:
  WIN01-C. Do not forcibly terminate execution
• Page:
  WIN02-C. Restrict privileges when spawning child processes
• Page:
  WIN03-C. Understand HANDLE inheritance
• Page:
  WIN04-C. Consider encrypting function pointers