Secure Coding in C and C++
Producing secure programs requires secure designs. However, even the best designs can lead to insecure programs if developers are unaware of the many security pitfalls inherent in C and C++ programming. This four-day course provides a detailed explanation of common programming errors in C and C++ and describes how these errors can lead to code that is vulnerable to exploitation. The course concentrates on security issues intrinsic to the C and C++ programming languages and associated libraries. The intent is for this course to be useful to anyone involved in developing secure C and C++ programs regardless of the specific application.
Please note: you must bring a laptop computer equipped with the latest version of Adobe Reader and VMware Player. See the Prerequisites section for download information.
The course assumes basic C and C++ programming skills but does not assume an in-depth knowledge of software security. The ideas presented apply to various development environments, but the examples are specific to Microsoft Visual Studio and Linux/GCC and the Intel 64-bit and 32-bit Architectures (x86-64 and IA-32). Material in this presentation was derived from Secure Coding in C and C++, Second Edition, SEI CERT C Coding Standard (2016 Edition) and SEI CERT C++ Coding Standard (2016 Edition). The two SEI CERT Coding Standards, for C and C++, are both available as free downloads. To learn more about the CERT Secure Coding eLearning and Professional Certificates, please go to: SEI Certificates
This course is designed for C and C++ developers.
Participants should come away from this course with a working knowledge of common programming errors that lead to software vulnerabilities, how these errors can be exploited, and effective mitigation strategies for preventing the introduction of these errors. In particular, participants will learn how to
- improve the overall security of any C or C++ application
- thwart buffer overflows and stack-smashing attacks that exploit insecure string manipulation logic
- avoid vulnerabilities and security flaws resulting from the incorrect use of dynamic memory management functions
- eliminate integer-related problems: integer overflows, sign errors, and truncation errors
- correctly use formatted output functions without introducing format-string vulnerabilities
- avoid I/O vulnerabilities, including race conditions
Moreover, this course encourages programmers to adopt security best practices and develop a security mindset that can help protect software from tomorrow's attacks, not just today's.
- string management
- dynamic memory management
- integer security
- formatted output
- file I/O
Subjects covered in the first two days are general, but examples are taken from both the Microsoft Visual Studio and GCC compilers on Windows and Linux platforms. Course material on integers uses examples from the x86-64 and IA-32 architectures.
The third and fourth days of the course focus on POSIX platforms. Doug Lea's malloc (dlmalloc) is used to demonstrate exploits in the Linux environment, while the file I/O sections focus on UNIX and the UNIX file system (UFS).
The Secure Coding in C and C++, Second Edition book will be provided in class. Participants will also receive a CD containing course and reference materials, including the 2016 Editions of the SEI CERT C Coding Standard and the SEI CERT C++ Coding Standard, which are also available as free downloads.
It is recommended that participants have a basic to intermediate understanding of the C and C++ programming languages. Software security knowledge or experience is not required.
Students must bring a personal computer equipped with
- 3GB or greater of free hard disk space
- CD-ROM or memory stick
- the latest version of Adobe Reader (this can be downloaded from http://www.adobe.com/products/acrobat/readstep2.html)
- the latest version of VMware Player (this can be downloaded from http://www.vmware.com/download/player/)
- A Zip decompression utility, such as WinZip
The following items are optional. We provide them, but the student is free to substitute their own if they wish:
- C/C++ programming language development environments (compiler, editor, etc.), such as Microsoft Visual Studio
- Word processor, such as Microsoft Word, or OpenOffice Writer.
On the first day of the course, the instructor will provide the attendees with a DVD with the software and course exercises to download on their computers. The instructor will also provide instructions on using the Rosebud Virtual Machine (VM) from the DVDs. The DVD also contains Microsoft Visual Studio Express 2010, and students may use it to do the exercises if they wish (it is not required). Microsoft provides the download free at: https://www.visualstudio.com.
Training courses provided by the SEI are not academic courses for academic credit toward a degree. Any certificates provided are evidence of the completion of the courses and are not official academic credentials. For more information about SEI training courses, see Registration Terms and Conditions and Confidentiality of Course Records.