SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems iii
Software Engineering Institute | Carnegie Mellon University
[DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution.
10 Input/Output (FIO) 281
10.1 FIO30-C. Exclude user input from format strings 281
10.2 FIO32-C. Do not perform operations on devices that are only appropriate for files 285
10.3 FIO34-C. Distinguish between characters read from a file and EOF or WEOF 291
10.4 FIO37-C. Do not assume that fgets() or fgetws() returns a nonempty string when
successful 296
10.5 FIO38-C. Do not copy a FILE object 299
10.6 FIO39-C. Do not alternately input and output from a stream without an intervening
flush or positioning call 301
10.7 FIO40-C. Reset strings on fgets() or fgetws() failure 304
10.8 FIO41-C. Do not call getc(), putc(), getwc(), or putwc() with a stream argument that
has side effects 306
10.9 FIO42-C. Close files when they are no longer needed 309
10.10 FIO44-C. Only use values for fsetpos() that are returned from fgetpos() 313
10.11 FIO45-C. Avoid TOCTOU race conditions while accessing files 315
10.12 FIO46-C. Do not access a closed file 319
10.13 FIO47-C. Use valid format strings 321
11 Environment (ENV) 326
11.1 ENV30-C. Do not modify the object referenced by the return value of certain functions 326
11.2 ENV31-C. Do not rely on an environment pointer following an operation that may
invalidate it 331
11.3 ENV32-C. All exit handlers must return normally 336
11.4 ENV33-C. Do not call system() 340
11.5 ENV34-C. Do not store pointers returned by certain functions 347
12 Signals (SIG) 353
12.1 SIG30-C. Call only asynchronous-safe functions within signal handlers 353
12.2 SIG31-C. Do not access shared objects in signal handlers 363
12.3 SIG34-C. Do not call signal() from within interruptible signal handlers 367
12.4 SIG35-C. Do not return from a computational exception signal handler 371
13 Error Handling (ERR) 374
13.1 ERR30-C. Set errno to zero before calling a library function known to set errno,
and check errno only after the function returns a value indicating failure 374
13.2 ERR32-C. Do not rely on indeterminate values of errno 381
13.3 ERR33-C. Detect and handle standard library errors 386
14 Concurrency (CON) 403
14.1 CON30-C. Clean up thread-specific storage 403
14.2 CON31-C. Do not destroy a mutex while it is locked 407
14.3 CON32-C. Prevent data races when accessing bit-fields from multiple threads 410
14.4 CON33-C. Avoid race conditions when using library functions 414
14.5 CON34-C. Declare objects shared between threads with appropriate storage durations 418
14.6 CON35-C. Avoid deadlock by locking in a predefined order 426
14.7 CON36-C. Wrap functions that can spuriously wake up in a loop 431
14.8 CON37-C. Do not call signal() in a multithreaded program 435
14.9 CON38-C. Preserve thread safety and liveness when using condition variables 437
14.10 CON39-C. Do not join or detach a thread that was previously joined or detached 445
评论0