CERT C Programming Language Secure Coding Standard

Rules and Recommendations Regarding Integers
DCL31-C. Declare identifiers before using them	FIO09-C. Be careful with binary data when transferring data across systems

Rules and Recommendations Regarding Input
FIO02-C. Canonicalize path names originating from tainted sources	FIO13-C. Never push back anything other than one read character	FIO20-C. Avoid unintentional truncation when using fgets() or fgetws()	FIO30-C. Exclude user input from format strings	FIO37-C. Do not assume that fgets() or fgetws() returns a nonempty string when successful
FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call	FIO40-C. Reset strings on fgets() or fgetws() failure	INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs

Rules and Recommendations Regarding Characters
FIO41-C. Do not call getc(), putc(), getwc(), or putwc() with a stream argument that has side effects	INT07-C. Use only explicitly signed or unsigned char type for numeric values	MSC09-C. Character encoding: Use subset of ASCII for safety	MSC10-C. Character encoding: UTF8-related issues

Space shortcuts