Secure Programming Practices in C++

This talk uses well-known vulnerability patterns to examine dangerous parts of C++ and develop safer programming practices. It covers undefined behavior, overflows, type conversions, and language constructs that can reduce risk.

Syllabus

Introduction
Agenda
What kind of specs exists
C Core Guidelines
C Coding Standard
Common Weakness Enumeration
Undefined Behavior
Undefined Behavior Example
Compiler Optimizations
The Disappearing Memset
Live Demo
References
Era of the SAE
Exploitability
Sign Integer Overflow
Overflows
Buffer Underflow
Incorrect Type Conversion
The Good Thing
Use Your Tools
Avoid loops
Save casts
Allocation
Garbage Collection
Make Sure
No Semantics
enum class
string literal
loop
literals
struct
quote operator
semantics to numbers
sizes
fuzzers
taint
pointer
clever code
shared pointer
shared state
modern C