Secure Coding in C and C++ Book

Foreword.

Preface.

About the Author.

1. Running with Scissors.

Gauging the Threat

Security Concepts

C and C++

Development Platforms

Summary

Further Reading

2. Strings.

String Characteristics

Common String Manipulation Errors

String Vulnerabilities

Process Memory Organization

Stack Smashing

Code Injection

Arc Injection

Mitigation Strategies

Notable Vulnerabilities

Summary

Further Reading

3. Pointer Subterfuge.

Data Locations

Function Pointers

Data Pointers

Modifying the Instruction Pointer

Global Offset Table

The .dtors Section

Virtual Pointers

The atexit() and on_exit() Functions

The longjmp() Function

Exception Handling

Mitigation Strategies

Summary

Further Reading

4. Dynamic Memory Management.

Dynamic Memory Management

Common Dynamic Memory Management Errors

Doug Lea's Memory Allocator

RtlHeap

Mitigation Strategies

Notable Vulnerabilities

Summary

Further Reading

5. Integer Security.

Integers

Integer Conversions

Integer Error Conditions

Integer Operations

Vulnerabilities

Nonexceptional Integer Logic Errors

Mitigation Strategies

Notable Vulnerabilities

Summary

Further Reading

6. Formatted Output.

Variadic Functions

Formatted Output Functions

Exploiting Formatted Output Functions

Stack Randomization

Mitigation Strategies

Notable Vulnerabilities

Summary

Further Reading

7. File I/O.

Concurrency

Time of Check, Time of Use

Files as Locks and File Locking

File System Exploits

Mitigation Strategies

Summary

8.Recommended Practices.

Secure Software Development Principles

Systems Quality Requirements Engineering

Threat Modeling

Use/Misuse Cases

Architecture and Design

Off-the-Shelf Software

Compiler Checks

Input Validation

Data Sanitization

Static Analysis

Quality Assurance

Memory Permissions

Defense in Depth

TSP-Secure

Summary

Further Reading

References.

Acronyms.

Index.