ISO/IEC TS 17961:2013
Information technology - Programming languages, their environments and system software interfaces - C secure coding rules
ISO/IEC TS 17961:2013 specifies
- rules for secure coding in the C programming language, and
- code examples.
ISO/IEC TS 17961:2013 does not specify
- the mechanism by which these rules are enforced, or
- any particular coding style to be enforced.
Each rule in this Technical Specification is accompanied by code examples. Two distinct kinds of examples are provided:
- noncompliant examples demonstrating language constructs that have weaknesses with potentially exploitable security implications; such examples are expected to elicit a diagnostic from a conforming analyzer for the affected language construct; and
- compliant examples are expected not to elicit a diagnostic.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$386.00 NZD
|
|
| HardCopy |
$430.00 NZD
|
|
| Networkable PDF |
Price varies
|
Table tab_1
Section sec_1
Section sec_2
Section sec_2.1
Section sec_3
Section sec_4
Section sec_4.1
Section sec_4.2
Section sec_4.3
Section sec_4.4
Section sec_4.5
Section sec_4.6
Section sec_4.7
Section sec_4.8
Section sec_4.9
Section sec_4.10
Section sec_4.11
Section sec_4.12
Section sec_4.13
Section sec_4.14
Section sec_4.15
Section sec_4.16
Section sec_4.17
Section sec_4.18
Section sec_4.19
Section sec_4.20
Section sec_4.21
Section sec_4.22
Section sec_5
Section sec_5.1
Section sec_5.2
Section sec_5.3
Section sec_5.4
Section sec_5.5
Section sec_5.6
Section sec_5.7
Section sec_5.8
Section sec_5.9
Section sec_5.10
Section sec_5.11
Section sec_5.12
Section sec_5.13
Section sec_5.14
Section sec_5.15
Section sec_5.16
Section sec_5.17
Section sec_5.18
Section sec_5.19
Table tab_2
Table tab_3
Section sec_5.20
Section sec_5.20.1
Section sec_5.20.2
Section sec_5.20.3
Section sec_5.21
Section sec_5.22
Section sec_5.23
Section sec_5.24
Section sec_5.25
Section sec_5.25.1
Table tab_4
Section sec_5.25.2
Table tab_5
Section sec_5.25.3
Table tab_6
Section sec_5.25.4
Section sec_5.25.5
Section sec_5.26
Section sec_5.27
Section sec_5.28
Section sec_5.29
Section sec_5.30
Section sec_5.31
Section sec_5.32
Section sec_5.33
Section sec_5.34
Section sec_5.35
Section sec_5.36
Section sec_5.37
Section sec_5.38
Section sec_5.39
Section sec_5.40
Section sec_5.41
Section sec_5.42
Section sec_5.43
Section sec_5.44
Section sec_5.45
Section sec_5.46
Annex sec_A
Annex sec_A.1
Annex sec_A.2
Annex sec_A.3
Annex sec_A.4
Annex sec_A.5
Annex sec_A.6
Annex sec_B
Table tab_B.1
Annex sec_C
Annex sec_D
Reference ref_1
Reference ref_2
Reference ref_3
Reference ref_4
Reference ref_5
Reference ref_6
Reference ref_7
Reference ref_8
Reference ref_9
Reference ref_10
Reference ref_11
Reference ref_12
Reference ref_13
Reference ref_14
Reference ref_15
Reference ref_16
Reference ref_17
Reference ref_18
Reference ref_19
Reference ref_20
Reference ref_21
Reference ref_22
Reference ref_23
Reference ref_24
Reference ref_25
Reference ref_26
Reference ref_27
Reference ref_28
Reference ref_29
Reference ref_30
Reference ref_31
Reference ref_32
Reference ref_33
Reference ref_34
Reference ref_35
Reference ref_36
Reference ref_37
Reference ref_38
Reference ref_39
Reference ref_40
Reference ref_41
Reference ref_42
Reference ref_43
Reference ref_44
Reference ref_45
Reference ref_46
Reference ref_47
Reference ref_48
Reference ref_49
Reference ref_50
Reference ref_51
Foreword
Introduction
1 Scope
2 Conformance
2.1 Portability assumptions
3 Normative references
4 Terms and definitions
5 Rules
5.1 Accessing an object through a pointer to an incompatible type [ptrcomp]
5.2 Accessing freed memory [accfree]
5.3 Accessing shared objects in signal handlers [accsig]
5.4 No assignment in conditional expressions [boolasgn]
5.5 Calling functions in the C Standard Library other than abort, _Exit, and signal from within a signal handler [asyncsig]
5.6 Calling functions with incorrect arguments [argcomp]
5.7 Calling signal from interruptible signal handlers [sigcall]
5.8 Calling system [syscall]
5.9 Comparison of padding data [padcomp]
5.10 Converting a pointer to integer or integer to pointer [intptrconv]
5.11 Converting pointer values to more strictly aligned pointer types [alignconv]
5.12 Copying a FILE object [filecpy]
5.13 Declaring the same function or object in incompatible ways [funcdecl]
5.14 Dereferencing an out-of-domain pointer [nullref]
5.15 Escaping of the address of an automatic object [addrescape]
5.16 Conversion of signed characters to wider integer types before a check for EOF [signconv]
5.17 Use of an implied default in a switch statement [swtchdflt]
5.18 Failing to close files or free dynamic memory when they are no longer needed [fileclose]
5.19 Failing to detect and handle standard library errors [liberr]
5.20 Forming invalid pointers by library function [libptr]
5.21 Allocating insufficient memory [insufmem]
5.22 Forming or using out-of-bounds pointers or array subscripts [invptr]
5.23 Freeing memory multiple times [dblfree]
5.24 Including tainted or out-of-domain input in a format string [usrfmt]
5.25 Incorrectly setting and using errno [inverrno]
5.26 Integer division errors [diverr]
5.27 Interleaving stream inputs and outputs without a flush or positioning call [ioileave]
5.28 Modifying string literals [strmod]
5.29 Modifying the string returned by getenv, localeconv, setlocale, and strerror [libmod]
5.30 Overflowing signed integers [intoflow]
5.31 Passing a non-null-terminated character sequence to a library function that expects a string [nonnullcs]
5.32 Passing arguments to character-handling functions that are not representable as unsigned char [chrsgnext]
5.33 Passing pointers into the same object as arguments to different restrict-qualified parameters [restrict]
5.34 Reallocating or freeing memory that was not dynamically allocated [xfree]
5.35 Referencing uninitialized memory [uninitref]
5.36 Subtracting or comparing two pointers that do not refer to the same array [ptrobj]
5.37 Tainted strings are passed to a string copying function [taintstrcpy]
5.38 Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr]
5.39 Using a tainted value as an argument to an unprototyped function pointer [taintnoproto]
5.40 Using a tainted value to write to an object using a formatted input or output function [taintformatio]
5.41 Using a value for fsetpos other than a value returned from fgetpos [xfilepos]
5.42 Using an object overwritten by getenv, localeconv, setlocale, and strerror [libuse]
5.43 Using character values that are indistinguishable from EOF [chreof]
5.44 Using identifiers that are reserved for the implementation [resident]
5.45 Using invalid format strings [invfmtstr]
5.46 Tainted, potentially mutilated, or out-of-domain integer values are used in a restricted sink [taintsink]
Annex A (informative) Intra- to Interprocedural Transformations
Annex B (informative) Undefined Behavior
Annex C (informative) Related Guidelines and References
Annex D (informative) Decidability of Rules
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 3968.0:1994
Information technology - Database languages - SQL - Definition of data structures and basic operations
-
AS/NZS 3968.0:1994 A1
Information technology - Database languages - SQL - Definition of data structures and basic operations: Amendment 1
-
AS/NZS 3968.3:1998
Information technology - Database languages - SQL - Call-level interface
-
AS/NZS ISO/IEC 14882:2022
Programming languages – C++
Table tab_1
Section sec_1
Section sec_2
Section sec_2.1
Section sec_3
Section sec_4
Section sec_4.1
Section sec_4.2
Section sec_4.3
Section sec_4.4
Section sec_4.5
Section sec_4.6
Section sec_4.7
Section sec_4.8
Section sec_4.9
Section sec_4.10
Section sec_4.11
Section sec_4.12
Section sec_4.13
Section sec_4.14
Section sec_4.15
Section sec_4.16
Section sec_4.17
Section sec_4.18
Section sec_4.19
Section sec_4.20
Section sec_4.21
Section sec_4.22
Section sec_5
Section sec_5.1
Section sec_5.2
Section sec_5.3
Section sec_5.4
Section sec_5.5
Section sec_5.6
Section sec_5.7
Section sec_5.8
Section sec_5.9
Section sec_5.10
Section sec_5.11
Section sec_5.12
Section sec_5.13
Section sec_5.14
Section sec_5.15
Section sec_5.16
Section sec_5.17
Section sec_5.18
Section sec_5.19
Table tab_2
Table tab_3
Section sec_5.20
Section sec_5.20.1
Section sec_5.20.2
Section sec_5.20.3
Section sec_5.21
Section sec_5.22
Section sec_5.23
Section sec_5.24
Section sec_5.25
Section sec_5.25.1
Table tab_4
Section sec_5.25.2
Table tab_5
Section sec_5.25.3
Table tab_6
Section sec_5.25.4
Section sec_5.25.5
Section sec_5.26
Section sec_5.27
Section sec_5.28
Section sec_5.29
Section sec_5.30
Section sec_5.31
Section sec_5.32
Section sec_5.33
Section sec_5.34
Section sec_5.35
Section sec_5.36
Section sec_5.37
Section sec_5.38
Section sec_5.39
Section sec_5.40
Section sec_5.41
Section sec_5.42
Section sec_5.43
Section sec_5.44
Section sec_5.45
Section sec_5.46
Annex sec_A
Annex sec_A.1
Annex sec_A.2
Annex sec_A.3
Annex sec_A.4
Annex sec_A.5
Annex sec_A.6
Annex sec_B
Table tab_B.1
Annex sec_C
Annex sec_D
Reference ref_1
Reference ref_2
Reference ref_3
Reference ref_4
Reference ref_5
Reference ref_6
Reference ref_7
Reference ref_8
Reference ref_9
Reference ref_10
Reference ref_11
Reference ref_12
Reference ref_13
Reference ref_14
Reference ref_15
Reference ref_16
Reference ref_17
Reference ref_18
Reference ref_19
Reference ref_20
Reference ref_21
Reference ref_22
Reference ref_23
Reference ref_24
Reference ref_25
Reference ref_26
Reference ref_27
Reference ref_28
Reference ref_29
Reference ref_30
Reference ref_31
Reference ref_32
Reference ref_33
Reference ref_34
Reference ref_35
Reference ref_36
Reference ref_37
Reference ref_38
Reference ref_39
Reference ref_40
Reference ref_41
Reference ref_42
Reference ref_43
Reference ref_44
Reference ref_45
Reference ref_46
Reference ref_47
Reference ref_48
Reference ref_49
Reference ref_50
Reference ref_51
Foreword
Introduction
1 Scope
2 Conformance
2.1 Portability assumptions
3 Normative references
4 Terms and definitions
5 Rules
5.1 Accessing an object through a pointer to an incompatible type [ptrcomp]
5.2 Accessing freed memory [accfree]
5.3 Accessing shared objects in signal handlers [accsig]
5.4 No assignment in conditional expressions [boolasgn]
5.5 Calling functions in the C Standard Library other than abort, _Exit, and signal from within a signal handler [asyncsig]
5.6 Calling functions with incorrect arguments [argcomp]
5.7 Calling signal from interruptible signal handlers [sigcall]
5.8 Calling system [syscall]
5.9 Comparison of padding data [padcomp]
5.10 Converting a pointer to integer or integer to pointer [intptrconv]
5.11 Converting pointer values to more strictly aligned pointer types [alignconv]
5.12 Copying a FILE object [filecpy]
5.13 Declaring the same function or object in incompatible ways [funcdecl]
5.14 Dereferencing an out-of-domain pointer [nullref]
5.15 Escaping of the address of an automatic object [addrescape]
5.16 Conversion of signed characters to wider integer types before a check for EOF [signconv]
5.17 Use of an implied default in a switch statement [swtchdflt]
5.18 Failing to close files or free dynamic memory when they are no longer needed [fileclose]
5.19 Failing to detect and handle standard library errors [liberr]
5.20 Forming invalid pointers by library function [libptr]
5.21 Allocating insufficient memory [insufmem]
5.22 Forming or using out-of-bounds pointers or array subscripts [invptr]
5.23 Freeing memory multiple times [dblfree]
5.24 Including tainted or out-of-domain input in a format string [usrfmt]
5.25 Incorrectly setting and using errno [inverrno]
5.26 Integer division errors [diverr]
5.27 Interleaving stream inputs and outputs without a flush or positioning call [ioileave]
5.28 Modifying string literals [strmod]
5.29 Modifying the string returned by getenv, localeconv, setlocale, and strerror [libmod]
5.30 Overflowing signed integers [intoflow]
5.31 Passing a non-null-terminated character sequence to a library function that expects a string [nonnullcs]
5.32 Passing arguments to character-handling functions that are not representable as unsigned char [chrsgnext]
5.33 Passing pointers into the same object as arguments to different restrict-qualified parameters [restrict]
5.34 Reallocating or freeing memory that was not dynamically allocated [xfree]
5.35 Referencing uninitialized memory [uninitref]
5.36 Subtracting or comparing two pointers that do not refer to the same array [ptrobj]
5.37 Tainted strings are passed to a string copying function [taintstrcpy]
5.38 Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr]
5.39 Using a tainted value as an argument to an unprototyped function pointer [taintnoproto]
5.40 Using a tainted value to write to an object using a formatted input or output function [taintformatio]
5.41 Using a value for fsetpos other than a value returned from fgetpos [xfilepos]
5.42 Using an object overwritten by getenv, localeconv, setlocale, and strerror [libuse]
5.43 Using character values that are indistinguishable from EOF [chreof]
5.44 Using identifiers that are reserved for the implementation [resident]
5.45 Using invalid format strings [invfmtstr]
5.46 Tainted, potentially mutilated, or out-of-domain integer values are used in a restricted sink [taintsink]
Annex A (informative) Intra- to Interprocedural Transformations
Annex B (informative) Undefined Behavior
Annex C (informative) Related Guidelines and References
Annex D (informative) Decidability of Rules
Bibliography