Accession Number:

ADA528573

Title:

Specifications for Managed Strings, Second Edition

Descriptive Note:

Technical rept.

Corporate Author:

CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST

Personal Author(s):

• Burch, Hal
• Long, Fred
• Rungta, Raunak
• Seacord, Robert
• Svoboda, David

Report Date:

2010-05-01

Pagination or Media Count:

47.0

Abstract:

This report describes a managed string library for the C programming language. Many software vulnerabilities in C programs result from the misuse of manipulation functions for standard C strings. Programming errors common to string-manipulation logic include buffer overflow, truncation errors, string termination errors, and improper data sanitization. The managed string library provides mechanisms to eliminate or mitigate these problems and improve system security. The CERT Program, which is part of the Carnegie Mellon Software Engineering Institute, provides a proof-of-concept implementation of the managed string library on its Secure Coding web pages.

Descriptors:

• *C PROGRAMMING LANGUAGE
• SOFTWARE ENGINEERING
• COMPUTER PROGRAMMING
• ERRORS
• LIBRARIES
• TRUNCATION
• COMPUTER PROGRAMS
• CODING

Subject Categories:

• Computer Programming and Software
• Computer Systems Management and Standards

Distribution Statement:

APPROVED FOR PUBLIC RELEASE