Appendix B: Summary of Dos andDonts

This appendix is a summary of all the Do, Dont and Consider tips provided at the end of each sin in the book. We added it because every once in a while, just enough to be aggravating, developers want to understand what they should and should not do when writing code rather than reading an entire book.

Sin 1: Buffer Overruns Summary

• Do carefully check your buffer accesses by using safe string and buffer handling functions.

• Do use compiler-based defenses such as /GS and ProPolice.

• Do use operating-system-level buffer overrun defenses such as DEP and PaX.

• Do understand what data the attacker controls, and manage that data safely in your code.

• Do not think that compiler and OS defenses are sufficientthey are not; they are simply extra defenses.

• Do not create new code that uses unsafe functions.

• Consider updating your C/C++ compiler since the compiler authors add more defenses to the generated code.

• Consider removing unsafe functions from old code over time.

• Consider using C++ string and container classes rather than low-level C string functions.