What is the top dangerous mistakes in C programming?

for example misusing a strcpy causes a stack-overflow and code injection.

I'm looking for at least 10 bad programming pattern in C.

closed as too broad by user10211, NULLZ, Adi, Gilles 'SO- stop being evil', Lucas Kauffman Aug 9 '13 at 12:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Not knowing what you are doing is No.1. Flagging to close as a bad subjective. – Deer Hunter Aug 9 '13 at 9:00
  • 2
    I'm looking for a top ten of risky mistakes in C? what do yo want to know more? I'm a C developer and i want to avoid them. – NewMrd Aug 9 '13 at 9:20
  • My list andromeda.com/people/ddyer/topten.html – ddyer Aug 11 '13 at 3:13

I think, the best way to learn the answer to this question is reading a lot of book and doing best practies. I advice you this book Secure Coding in C and C++ to all topic about secure coding in c.


The topmost dangerous mistake in C programming is using C. This is an unpopular assertion, but decades of experience back me up.

C is a nice programming language in that it allows you to express operations in an "abstract machine" (that's how the C standard puts it) which will get translated efficiently into machine code (the translation tools runs fast and the result is fast). However, this translation comes at a high price, namely that they are no safeguard for mistakes, and there are a lot of "undefined behaviours" lurking in the shadows. Pointer aliasing rules, for instance, are almost never understood correctly, leading to seemingly good code which will fail (sometimes in ways which create exploitable vulnerabilities) when a newer compiler is used or an optimization switch activated.

Looking for a "list of mistake" is the wrong mindset. You want a blacklist: things to avoid, under the assumption that "everything else" is safe. You should want a whitelist: a list of allowed ways to develop, at the exclusion of everything else. Successful C programmers are programmers who are able to maintain their own discipline to never use any construction that they do not master from end-to-end; and by "mastering" I mean the ability to describe how the C compiler will translate that into assembly opcodes, including all the possible optimizations that C compilers are allowed to make.

A good way to "use C" is to write the one or two routines which really need speed in some optimized C, and the rest of the code in a safer language which will allow for faster, easier and safer development (e.g. Python, C#, Node.js, Perl... the choice is large).


You can look at the CWE/SANS Top 25 Most Dangerous Software Errors. This is for software development in general (independent of programming language) but also includes errors made in C/C++.

Not the answer you're looking for? Browse other questions tagged or ask your own question.