Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The C++ rules and recommendations in this wiki are a work in progress and reflect the current thinking of the secure coding community. Because this is a development website, many pages are incomplete or contain errors. As rules and recommendations mature, they are published in report or book form as official releases. These releases are issued as dictated by the needs and interests of the secure software development community.

The CERT C++ Coding Standard does not currently expose any recommendations; all C++ recommendations have been removed (moved to The Void section) due to quality concerns pending further review and development.

Create a sign-in account if you want to comment on existing content. If you wish to be more involved and directly edit content on the site, you still need an account, but you'll also need to request edit privileges

Front Matter  

Content by Label
showLabelsfalse
max99
spaces@self
showSpacefalse
sorttitle
reversetrue
cqllabel = "front-matter" and space = currentSpace()
labels+intro

Rules

 

Content by Label
showLabelsfalse
max99
spaces@self
showSpacefalse
sorttitle
cqllabel = "rule-list" and label != "void" and space = currentSpace()
labels+rule-list,-void

 

Back Matter

 

Content by Label
showLabelsfalse
max99
spaces@self
showSpacefalse
sorttitle
cqllabel = "bm" and label not in ("cwe-sans","void") and space = currentSpace()
labels+bm -void -cwe-sans

...

borderColor#B0B1BA
bgColor#fafafa
titleColor#ffffff
borderWidth1
titleBGColor#B0B1BA
borderStylesolid
titleSecure C++ Coding Books and Downloads

Image Removed The CERT C++ Coding Standard, 2016 Edition provides rules to help programmers ensure that their C++ code reduces security flaws by following secure coding best practices.  It is downloadable as a PDF.  (errata)

Image RemovedThe CERT C++ Coding Standard references and relies on the CERT C Coding Standard. The CERT C Coding Standard, 2016 Edition provides rules to help programmers ensure that their code complies with the new C11 standard and earlier standards, including C99.  It is downloadable as a PDF.  (errata)

Image RemovedSecure Coding in C and C++ identifies the root causes of today's most widespread software vulnerabilities, shows how they can be exploited, reviews the potential consequences, and presents secure alternatives.

Panel
borderColor#B0B1BA
bgColor#fafafa
titleColor#ffffff
borderWidth1
titleBGColor#B0B1BA
borderStylesolid
titleContact Us

Contact us if you

  • have questions about this wiki
  • have recommendations for standards in development
  • want to request privileges to participate in standards development
Panel
borderColor#B0B1BA
bgColor#fafafa
titleColor#ffffff
borderWidth1
titleBGColor#B0B1BA
borderStylesolid
titleThank You!

We acknowledge the contributions of the following folks, and we look forward to seeing your name here as well.  

...

Info
titleLinking to Our Pages

Link to guidelines using the Tiny Link under Tools→Link to this Page... (This URL will not change if the name of the guideline changes.)   

...

titleInformation for Editors

...

Info

This page was automatically generated and should not be edited.

The information on this page was provided by outside contributors and has not been verified by SEI CERT.

CERT Rule

Related Guidelines

DCL51-CPPDCL58-CPP. Do not modify the standard namespaces
DCL54-CPPMEM51-CPP. Properly deallocate dynamically allocated resources
DCL57-CPPERR55-CPP. Honor exception specifications
DCL57-CPPERR50-CPP. Do not abruptly terminate the program
DCL58-CPPDCL51-CPP. Do not declare or define a reserved identifier
DCL59-CPPDCL60-CPP. Obey the one-definition rule 
EXP51-CPPCTR56-CPP. Do not use pointer arithmetic on polymorphic objects
EXP51-CPPOOP52-CPP. Do not delete a polymorphic object without a virtual destructor
EXP58-CPPDCL50-CPP. Do not define a C-style variadic function
EXP61-CPPEXP54-CPP. Do not access an object outside of its lifetime
EXP62-CPPOOP57-CPP. Prefer special member functions and overloaded operators to C Standard Library functions
CTR51-CPPSTR52-CPP. Use valid references, pointers, and iterators to reference elements of a basic_string
CTR52-CPPSTR50-CPP. Guarantee that storage for strings has sufficient space for character data and the null terminator
CTR53-CPPCTR51-CPP. Use valid references, pointers, and iterators to reference elements of a container
CTR53-CPPCTR57-CPP. Provide a valid ordering predicate
STR52-CPPCTR51-CPP. Use valid references, pointers, and iterators to reference elements of a container
STR53-CPPCTR50-CPP. Guarantee that container indices and iterators are within the valid range
MEM50-CPPEXP54-CPP. Do not access an object outside of its lifetime
MEM50-CPPMEM52-CPP. Detect and handle memory allocation errors
MEM51-CPPMEM53-CPP. Explicitly construct and destruct objects when manually managing object lifetime
MEM53-CPPMEM51-CPP. Properly deallocate dynamically allocated resources
MEM54-CPPMEM50-CPP. Do not access freed memory
MEM55-CPPDCL54-CPP. Overload allocation and deallocation functions as a pair in the same scope
OOP56-CPP. Honor replacement handler requirements  
MEM56-CPPMEM50-CPP. Do not access freed memory
MEM56-CPPMEM51-CPP. Properly deallocate dynamically allocated resources
MEM57-CPPMEM54-CPP. Provide placement new with properly aligned pointers to sufficient storage capacity
FIO51-CPPMEM51-CPP. Properly deallocate dynamically allocated resources
ERR50-CPPERR51-CPP. Handle all exceptions
ERR50-CPPERR55-CPP. Honor exception specifications
ERR50-CPPDCL57-CPP. Do not let exceptions escape from destructors or deallocation functions
ERR55-CPPERR50-CPP. Do not abruptly terminate the program
ERR56-CPPERR51-CPP. Handle all exceptions
ERR57-CPPMEM51-CPP. Properly deallocate dynamically allocated resources
MEM52-CPP. Detect and handle memory allocation errors
ERR56-CPP. Guarantee exception safety 
ERR58-CPPDCL57-CPP. Do not let exceptions escape from destructors or deallocation functions
ERR58-CPPERR55-CPP. Honor exception specifications
ERR60-CPPERR50-CPP. Do not abruptly terminate the program
ERR60-CPPERR55-CPP. Honor exception specifications
ERR61-CPPERR60-CPP. Exception objects must be nothrow copy constructible 
OOP51-CPPERR61-CPP. Catch exceptions by lvalue reference
OOP51-CPPCTR56-CPP. Do not use pointer arithmetic on polymorphic objects 
OOP52-CPPEXP51-CPP. Do not delete an array through a pointer of the incorrect type
OOP56-CPPMEM55-CPP. Honor replacement dynamic storage management requirements
OOP57-CPPEXP62-CPP. Do not access the bits of an object representation that are not part of the object's value representation
OOP58-CPPOOP54-CPP. Gracefully handle self-copy assignment
CON54-CPPCON55-CPP. Preserve thread safety and liveness when using condition variables
CON55-CPPCON54-CPP. Wrap functions that can spuriously wake up in a loop
MSC50-CPPMSC51-CPP. Ensure your random number generator is properly seeded