安全 C 编码实践
我正在寻找 C 语言安全编码实践的全面记录。由于我还没有找到这样的列表，我们不妨将其放入社区 wiki，以供进一步参考。我正在寻找安全问题的解决方案，例如基于堆栈和堆的缓冲区溢出和下溢、整数溢出和下溢、格式字符串攻击、空指针取消引用、堆/内存检查攻击等。
注意：除了编码实践之外，还可以防御的安全库针对此类攻击也值得一提。
LE：如本问题安全 C++ 编码实践所示，但仅适用于 C。
I am looking for a comprehensive record of secure coding practices in C. Since i haven't found such a list existing here already we might as well make this into a community wiki, for further reference. I am looking for solutions to security issues like stack and heap based buffer overflows and underflows, integer overflows and underflows, format string attacks, null pointer dereferencing, heap/memory inspection attacks, etc..
NB: Besides coding practices, secure libraries that defend against these kind of attacks are worth mentioning too.
LE: As seen in this question Secure C++ coding practices but for C only.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
CERT C“事实上的”标准相当知名，并在一定程度上解决了这些问题：
SEI CERT C 编码标准
市面上应该有好几款支持 CERT C 的静态分析仪。
The CERT C "de facto" standard is fairly well-known and addresses these issues at some extent:
SEI CERT C Coding Standard
There should be several static analyzers on the market that supports CERT C.
相同的答案 C 和 C++ 的安全编程手册：密码学、身份验证、输入验证和密码学的秘诀更多
从描述中：
读者将了解到：
如何避免常见编程
错误，例如缓冲区溢出，
竞争条件和格式字符串
问题
如何正确启用 SSL
应用程序
如何创建安全通道
客户端-服务器通信无需
SSL
如何整合公钥
基础设施（PKI）进入
应用程序 使用最佳实践
正确的密码学技术和
正确验证的策略
输入到程序
如何启动
安全地运行程序
如何使用文件
正确的访问机制
用于保护应用程序免受
逆向工程
Same answer Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Input Validation & More
From the description:
Readers will learn:
How to avoid common programming
errors, such as buffer overflows,
race conditions, and format string
problems
How to properly SSL-enable
applications
How to create secure channels for
client-server communication without
SSL
How to integrate Public Key
Infrastructure (PKI) into
applications Best practices for using
cryptography properly Techniques and
strategies for properly validating
input to programs
How to launch
programs securely
How to use file
access mechanisms properly
for protecting applications from
reverse engineering