Secure and defensive C

Why C needs extra care

C gives no automatic bounds checks, no automatic memory management and no exceptions. A missed check rarely produces an error message; it produces corrupted memory, a crash much later, or an exploitable security hole. A large share of serious security vulnerabilities in operating systems and browsers over the years have been memory-safety bugs in C and C++ code. Defensive habits are therefore part of writing C professionally.

Check every return value

FILE *f = fopen(path, "r");
if (!f) { perror(path); return -1; }

char *buf = malloc(n);
if (!buf) { fclose(f); return -1; }             /* clean up what you already have */

if (fscanf(f, "%d", &count) != 1) { … }
if (fclose(f) != 0) { perror("fclose"); }

Validate input at the boundary

Data from users, files, networks and sensors can be any length and any value. Check it where it enters the program: lengths before copying, ranges before using as indexes or sizes, formats before parsing. Inside the program, functions can then rely on valid data (and use assert to document that assumption, module 11).

Integer overflow in size calculations

/* Attacker sends count = 1073741825 records of 4 bytes each.
   count * 4 overflows a 32-bit size, so malloc gets a tiny number,
   and the loop then writes far past the small buffer. */
uint32_t count = read_count();
if (count > SIZE_MAX / sizeof(uint32_t)) return -1;      /* would overflow: reject */
uint32_t *items = malloc((size_t) count * sizeof *items);  /* or use calloc(count, sizeof *items) */

Hardening flags

gcc -std=c17 -O2 -Wall -Wextra -Wformat=2 -Wconversion \
    -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE -pie \
    prog.c -o prog

Coding standards used in industry

• SEI CERT C Coding Standard (Carnegie Mellon University): rules and recommendations for secure C, such as "do not form or use out-of-bounds pointers" and "guarantee that storage for strings has room for the null terminator".
• MISRA C: guidelines for safety-critical embedded software, widely required in automotive (and used in aerospace, rail and medical devices). It restricts risky features: for example dynamic memory allocation after start-up, unrestricted goto, and implicit conversions.
• Static analysis tools check code against these rules automatically: gcc -fanalyzer, clang-tidy, cppcheck, and commercial tools used by automotive suppliers.