tailieunhanh - Secure Coding in C and C++

"The security of information systems has not improved at a rate consistent with the growth and sophistication of the attacks being made against them. To address this problem, we must improve the underlying strategies and techniques used to create our systems. Specifically, we must build security in from the start, rather than append it as an afterthought. That's the point of Secure Coding in C and C++. In careful detail, this book shows software developers how to build high-quality systems that are less vulnerable to costly and even catastrophic attack. It's a book that every developer should read before the. | CERT Secure Coding in C and C Module 4 Dynamic Memory Management This material is approved for public release. Distribution is limited by the Software Engineering Institute to attendees. Software Engineering Institute Carnegie Mellon 2010 Carnegie Mellon University 2010 Carnegie Mellon University This material is distributed by the SEI only to course attendees for their own individual study. Except for the . government purposes described below this material SHALL NOT be reproduced or used in any other manner without requesting formal permission from the Software Engineering Institute at permission@. This material was created in the performance of Federal Government Contract Number FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute a federally funded research and development center. The . Government s rights to use modify reproduce release perform display or disclose this material are restricted by the Rights in Technical Data-Noncommercial Items clauses DFAR and DFAR Alternate I contained in the above identified contract. Any reproduction of this material or portions thereof marked with this legend must also reproduce the disclaimers contained on this slide. Although the rights granted by contract do not require course attendance to use this material for . Government purposes the SEI recommends attendance to ensure proper understanding. THE MATERIAL IS PROVIDED ON AN AS IS BASIS AND CARNEGIE MELLON DISCLAIMS ANY And all warranties implied or OTHERWISE INCLUDING BUT NOT LIMITED TO warranty oF fitness fOr a particular purpose results obtained frOm use OF the material Merchantability and or nOn-infringement . Software Engineering Institute CamegieMeUon 2 Agenda Dynamic Memory Management Common Dynamic Memory Management Errors Doug Lea s Memory Allocator Buffer Overflows Double-Free Mitigation Strategies Summary Software Engineering Institute CamegieMeUon