Secure Coding in C and C++

Seacord, R. C. (2013). Secure Coding in C and C++. Addison-Wesley.

Type

Book

Intellectual base

Textbook

Year

2013

ISBN

9780321822130

Link

https://www.sei.cmu.edu/library/secure-coding-in-c-and-c-second-edition/

Cited from

computer_science, systems_cybernetics

Cited by

3 citations across 3 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Escape and Leakage
  • Software systems: Memory leaks where allocated resources are never deallocated; API tokens and credentials escaping into version control systems; debug information leaking into production logs and error messages; temporary files persisting beyond their intended lifecycle—failure modes Seacord (2013) catalogs in his canonical reference on secure coding in C and C++.

    This sourceCanonical CERT/CC reference on software security defects; its coverage of dynamic memory management (memory leaks), resource lifecycle, and information-disclosure flaws catalogs concrete escape pathways arising from ordinary software boundary geometry.

    Supported in partVerified against the work's full text

    The description lists dynamic memory management (memory leaks) among the book's topics, but says nothing of credential leaks in version control, debug data in logs, or stale temporary files.

    “Straight from the world-renowned security experts at CERT/CC, Secure Coding in C and C++ (2nd Edition) identifies the root causes of today's most widespread software vulnerabilities, shows how they can be exploited, reviews the potential consequences, and presents secure alternatives. Fully updated for the new C++11 standard, Secure Coding in C and C++, Second Edition presents extensive new coverage of strings, …”

    Read by an automated reader; not a human review. How support was checked

• Silent Representation Overflow
  • Fixed-width arithmetic. An integer increments past its maximum and wraps; truncation of a wide value into a narrow field, two-digit year rollovers, and signed-32-bit time rollovers are the canonical cases.

    This sourceStandard reference (Chapter 5, integral security) on signed integer overflow, unsigned wraparound, and truncation as silent representation failures and their mitigations (range checks, wider types).

Domain-specific

• Resource leak
  • … example, the distinction between constitutive identity and a convenient observable transfers from A server opens a file on each request but skips close on one error path, eventually exhausting its descriptor table. to A cancellation race abandons a semaphore permit, gradually reducing concurrency until work stalls..

Verification

Does it exist? Confirmed. This work's ISBN resolves to a registered record, which fixes its identity. That is all it fixes.

Does it back the claim? Read against the text for 1 of 3 citations: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Links previously used in the corpus

Before the registry existed this work was also linked 1 other way.

• https://www.oreilly.com/library/view/secure-coding-in/9780132981989/ ×1

Registry ID ref:ab1a938530fa · see in the full table