Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the top dangerous mistakes in C programming?

for example misusing a strcpy causes a stack-overflow and code injection.

I'm looking for at least 10 bad programming pattern in C.

share|improve this question

closed as too broad by Terry Chia, NULLZ, Adi, Gilles, Lucas Kauffman Aug 9 '13 at 12:05

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Not knowing what you are doing is No.1. Flagging to close as a bad subjective. – Deer Hunter Aug 9 '13 at 9:00
I'm looking for a top ten of risky mistakes in C? what do yo want to know more? I'm a C developer and i want to avoid them. – NewMrd Aug 9 '13 at 9:20
My list – ddyer Aug 11 '13 at 3:13
up vote 1 down vote accepted

I think, the best way to learn the answer to this question is reading a lot of book and doing best practies. I advice you this book Secure Coding in C and C++ to all topic about secure coding in c.

share|improve this answer

The topmost dangerous mistake in C programming is using C. This is an unpopular assertion, but decades of experience back me up.

C is a nice programming language in that it allows you to express operations in an "abstract machine" (that's how the C standard puts it) which will get translated efficiently into machine code (the translation tools runs fast and the result is fast). However, this translation comes at a high price, namely that they are no safeguard for mistakes, and there are a lot of "undefined behaviours" lurking in the shadows. Pointer aliasing rules, for instance, are almost never understood correctly, leading to seemingly good code which will fail (sometimes in ways which create exploitable vulnerabilities) when a newer compiler is used or an optimization switch activated.

Looking for a "list of mistake" is the wrong mindset. You want a blacklist: things to avoid, under the assumption that "everything else" is safe. You should want a whitelist: a list of allowed ways to develop, at the exclusion of everything else. Successful C programmers are programmers who are able to maintain their own discipline to never use any construction that they do not master from end-to-end; and by "mastering" I mean the ability to describe how the C compiler will translate that into assembly opcodes, including all the possible optimizations that C compilers are allowed to make.

A good way to "use C" is to write the one or two routines which really need speed in some optimized C, and the rest of the code in a safer language which will allow for faster, easier and safer development (e.g. Python, C#, Node.js, Perl... the choice is large).

share|improve this answer

You can look at the CWE/SANS Top 25 Most Dangerous Software Errors. This is for software development in general (independent of programming language) but also includes errors made in C/C++.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.