SEI CERT C++ Coding Standard AA. Bibliography
<この項は書きかけです。順次追記します。>
SEI CERT C Coding Standard AA. Bibliography
https://wiki.sei.cmu.edu/confluence/display/c/AA.+Bibliography
で2015年時点でリンク切れが多く、調査し、なるべく近い情報を探してリンクを示した。
(ogawa.kiyoshi名)
C++は未着手であった。今回着手するにあたり、作業記録をここに示す。
迷うことがいろいろある。
データ継承を正式にしているかどうかを確かめるていない事項がある。
確認後、CERTC++に記載予定。
AA. Bibliography
[Abrahams 2010] Abrahams, David. Error and Exception Handling, #7. Boost Library. 2010.
https://www.boost.org/community/error_handling.html
[Banahan 2003] Banahan, Mike. The C Book . 2003.
http://webhome.phy.duke.edu/~rgb/General/c_book/c_book/index.html
[Barney 2010] Barney, Blaise. POSIX Threads Programming. Lawrence Livermore National Security, LLC. 2010.
https://computing.llnl.gov/tutorials/pthreads/
[Becker 2008] Becker, Pete. Working Draft, Standard for Programming Language C++. April 2008.
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2008/n2521.pdf
[Becker 2009] Becker, Pete Working Draft, Standard for Programming Language C++. September 2009.
http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2009/n3000.pdf
[Black 2007] Black, Paul E.; Kass, Michael; & Koo, Michael. Source Code Security Analysis Tool Functional Specification Version 1.0. Special Publication 500-268. Information Technology Laboratory (ITL). May 2007.
https://samate.nist.gov/docs/source_code_security_analysis_spec_SP500-268.pdf
[Cline 2009] Cline, Marshall. C++ FAQ Lite—Frequently Asked Questions. 1991-2009.
http://www.graphics.cornell.edu/~martin/docs/c++-faq
Page not found
->
http://www.dietmar-kuehl.de/mirror/c++-faq/
[CodeSourcery 2016a] CodeSourcery, Compaq, EDG, HP, IBM, Intel, Red Hat, SGI, et al. Itanium C++ ABI. December 2016 [accessed].
https://mentorembedded.github.io/cxx-abi/abi.html
404 File not found
->
https://itanium-cxx-abi.github.io/cxx-abi/abi.html
[CodeSourcery 2016b] CodeSourcery, Compaq, EDG, HP, IBM, Intel, Red Hat, SGI, et al. Itanium C++ ABI (Revision: 1,86). December 2016 [accessed].
https://refspecs.linuxbase.org/cxxabi-1.86.html#array-cookies
->
https://refspecs.linuxfoundation.org/cxxabi-1.86.html
[Coverity 2007] Coverity. Coverity Prevent User's Manual (3.3.0). 2007.
[CWE] MITRE. Common Weakness Enumeration – A Community-Developed Dictionary of Software Weakness Types.
http://cwe.mitre.org
[Dewhurst 2002] Dewhurst, Stephen C. C++ Gotchas: Avoiding Common Problems in Coding and Design. Addison-Wesley Professional. 2002.
https://www.oreilly.com/library/view/c-gotchas-avoiding/0321125185/
http://ptgmedia.pearsoncmg.com/images/9780321125187/samplepages/0321125185.pdf
[Dewhurst 2005] Dewhurst, Stephen C. C++ Common Knowledge: Essential Intermediate Programming. Addison-Wesley Professional. 2005.
https://dl.acm.org/citation.cfm?id=1050971
[DISA 2015] DISA. Application Security and Development Security Technical Implementation Guide, Version 3, Release 10. Accessed April 2015.
https://iase.disa.mil/stigs/Documents/U_Application_Security_and_Development_V3R10_STIG.zip
404 NOT FOUND
-> version4, release9
https://iase.disa.mil/stigs/app-security/app-security/Pages/index.aspx
[DISA 2016] DISA. Application Security and Development Security Technical Implementation Guide, Version 4, Release 1. Accessed January 2017.
https://iasecontent.disa.mil/stigs/zip/Aug2016/U_ASD_V4R1_STIG.zip
This XML file does not appear to have any style information associated with it. The document tree is shown below.
-> see above
[DISA 2018] DISA. Application Security and Development Security Technical Implementation Guide, Version 4, Release 8. Accessed January 2019.
https://iasecontent.disa.mil/stigs/zip/U_ASD_V4R8_STIG.zip
[Dowd 2006] Dowd, Mark; McDonald, John; & Schuh, Justin. Attacking delete and delete[] in C++. In The Art of Software Security Assessment. Addison-Wesley Professional. 2006.
http://www.informit.com/store/art-of-software-security-assessment-identifying-and-9780321444424
[Fortify 2006] Fortify Software Inc. Fortify Taxonomy: Software Security Errors. 2006.
http://www6.fortifysoftware.com/?s_token=1562724776.1369695503&kw=secure+code
->
http://www.e2college.com/blogs/security/security_code_review/common_software_security_errors/Fortifyaposs_Taxonomy_of_Software_Secu.html
Fortify's Taxonomy of Software Security Errors
Please refer to this URL: https://www.fortify.com/vulncat/en/vulncat/index.html
Since Fortify was bought by HP, the current link is here now: http://www.hpenterprisesecurity.com/vulncat/en/vulncat/index.html
[FSF 2005] Free Software Foundation. GCC Online Documentation. 2005.
https://gcc.gnu.org/onlinedocs/
[Gamma 1994] Gamma, Erich; Helm, Richard; Johnson, Ralph, & Vlissides, John. Design Patterns Elements of Reusable Object Oriented Software. Addison-Wesley Professional. 1994.
http://www.uml.org.cn/c++/pdf/DesignPatterns.pdf
[GNU 2016] gnu.org. GCC, the GNU Compiler Collection: Declaring Attributes of Functions. December 2016 [accessed].
https://gcc.gnu.org/onlinedocs/gcc/Function-Attributes.html
[Goldberg 1991] Goldberg, David. What Every Computer Scientist Should Know About Floating-Point Arithmetic. Sun Microsystems. March 1991.
http://docs.sun.com/source/806-3568/ncg_goldberg.html
[Graff 2003] Graff, Mark G. & Van Wyk, Kenneth R. Secure Coding: Principles and Practices. O'Reilly. 2003. ISBN 0596002424.
http://shop.oreilly.com/product/9780596002428.do
[Henricson 1997] Henricson, Mats & Nyquist, Erik. Industrial Strength C++. Prentice Hall PTR. 1997. ISBN 0-13-120965-5.
http://www.mypearsonstore.com/bookstore/industrial-strength-c-plus-plus-rules-and-recommendations-9780131209657?xid=PSED
[Hinnant 2005] Hinnant, Howard. RValue Reference Recommendations for Chapter 20. N1856=05-0116. August 2005.
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2005/n1856.html
[Hinnant 2015] Hinnant, Howard. Reply to "std::exception Why what() is returning a const char* and not a string?" ISO C++ Standard—Discussion. June 2015.
https://groups.google.com/a/isocpp.org/forum/#!msg/std-discussion/NiPG1hmo4ik/DePB57IPmJwJ
[IEC 60812 2006] Analysis techniques for system reliability - Procedure for failure mode and effects analysis (FMEA), 2nd ed. IEC 60812. IEC. January 2006.
-> Latest version, IEC 60812:2018
https://webstore.iec.ch/publication/26359
[IEEE Std 610.12 1990] IEEE. IEEE Standard Glossary of Software Engineering Terminology. 1990.
https://ieeexplore.ieee.org/document/159342
http://www.mit.jyu.fi/ope/kurssit/TIES462/Materiaalit/IEEE_SoftwareEngGlossary.pdf
[IEEE Std 1003.1:2013] IEEE & The Open Group. Standard for Information Technology—Portable Operating System Interface (POSIX). Base Specifications. Issue 7. 2013.
https://ieeexplore.ieee.org/document/6506091
->
The Open Group Base Specifications Issue 7, 2018 edition
IEEE Std 1003.1™-2017 (Revision of IEEE Std 1003.1-2008)
Copyright © 2001-2018 IEEE and The Open Group
https://pubs.opengroup.org/onlinepubs/9699919799/
[INCITS 2012] INCITS Document number N3396= 12-0096. Dynamic memory allocation for over-aligned data. 2012.
https://http//www.open-std.org/jtcl/sc22/wg21/docs/papers/2012/n3396.html
[INCITS 2014] INCITS PL22.16 & ISO WG21 C++ Standards Committee, Library Working Group (LWG). C++ Standard Library Active Issues List (Revision R88). N3967. 2014.
->
C++ Standard Library Active Issues List (Revision R115)
Revised 2019-04-02 at 17:55:19 UTC
http://www.open-std.org/jtc1/sc22/wg21/docs/lwg-active.html
[Internet Society 2000] The Internet Society. Internet Security Glossary (RFC 2828). 2000.
ftp://ftp.rfc-editor.org/in-notes/rfc2828.txt
[ISO/IEC 9899-1999] ISO/IEC 9899-1999. Programming Languages — C, Second Edition. 1999.
-> Technical Corrigendum 2, 2005
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1124.pdf
http://www.dii.uchile.cl/~daespino/files/Iso_C_1999_definition.pdf
[ISO/IEC 9899:2011] ISO/IEC. Programming Languages—C, 3rd ed. ISO/IEC 9899:2011. 2011.
-> related Committee Draft N1570:2011
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf
[ISO/IEC 14882-1998] ISO/IEC 14882-1998. Programming Languages — C++, First Edition. 1998.
-> X3J16/96-0225 X3, INFORMATION PROCESSING SYSTEMS WG21/N1043 Date: 2 December 1996
http://www.open-std.org/jtc1/sc22/open/n2356/
[ISO/IEC 14882-2003] ISO/IEC 14882-2003. Programming Languages — C++, Second Edition. 2003.
[ISO/IEC 14882-2011] ISO/IEC 14882-2011. Programming Languages — C++, Third Edition. 2011.
[ISO/IEC 14882-2014] ISO/IEC 14882-2014. Programming Languages — C++, Fourth Edition. 2014.
-> Related Working Draft N3797 2013-10-13
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2013/n3797.pdf
-> late Working Draft N4700
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2017/n4700.pdf
-> latest working Draft N4800
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/n4800.pdf
[ISO/IEC N3000 2009] Working Draft, Standard for Programming Language C++. November 2009.
http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2009/n3000.pdf
[ISO/IEC TR 24772:2013] ISO/IEC. Information Technology—Programming Languages—Guidance to Avoiding Vulnerabilities in Programming Languages through Language Selection and Use. TR 24772-2013. ISO. March 2013.
-> latest draft
http://www.open-std.org/jtc1/sc22/wg23/docs/ISO-IECJTC1-SC22-WG23_N0751-tr24772-1-after-pre-meeting-51-webex-20171016.pdf
[ISO/IEC TS 17961:2012] ISO/IEC TS 17961. Information Technology—Programming Languages, Their Environments and System Software Interfaces—C Secure Coding Rules. ISO. 2012.
-> N1624
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1624.pdf
[Jack 2007] Jack, Barnaby. Vector Rewrite Attack. Juniper Networks. May 2007.
https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf
[Kalev 1999] Kalev, Danny. ANSI/ISO C++ Professional Programmer's Handbook. Que. Corporation. 1999
http://www.doeacc.info/downloads/ebooks/Cpp%20ProfessionalProgrammersHandbook.pdf
[Lea 2000] Lea, Doug. Concurrent Programming in Java, 2nd Edition. Addison-Wesley Professional. 2000.
http://www.informit.com/store/concurrent-programming-in-java-design-principles-and-9780201310092
[Lions 1996] Lions, J. L. ARIANE 5 Flight 501 Failure Report. European Space Agency (ESA) & National Center for Space Study (CNES). July 1996.
https://en.wikisource.org/wiki/Ariane_501_Inquiry_Board_report
[Lions 1996] Lions, J. L. ARIANE 5 Flight 501 Failure Report. European Space Agency (ESA) & National Center for Space Study (CNES). July 1996.
[Lockheed Martin 2005] Lockheed Martin. Joint Strike Fighter Air Vehicle C++ Coding Standards for the System Development and Demonstration Program. Document Number 2RDU00001, Rev C. December 2005.
http://www.stroustrup.com/JSF-AV-rules.pdf
[Meyers 1996] Meyers, Scott. More Effective C++: 35 New Ways to Improve Your Programs and Designs. Addison-Wesley. 1996.
[Meyers 2001] Meyers, Scott. Effective STL: 50 Specific Ways to Improve Your Use of the Standard Template Library. Addison-Wesley Professional. 2001.
[Meyers 2005] Meyers, Scott. Effective C++: 55 Specific Ways to Improve Your Programs and Designs (3rd Edition). Addison-Wesley Professional. 2005.
[Meyers 2014] Meyers, Scott. Reply to The Drawbacks of Implementing Move Assignment in Terms of Swap [blog post]. The View from Aristeia: Scott Meyers' Professional Activities and Interests. 2014.
[Microsoft 2010] STL std::string class causes crashes and memory corruption on multi-processor machines. 2010.
http://support.microsoft.com/kb/813810
->申し訳ございません。ページが見つかりません。
[MISRA 2004] MIRA Limited. MISRA C: 2004 Guidelines for the Use of the C Language in Critical Systems. MIRA Limited. ISBN 095241564X. October 2004.
http://www.misra.org.uk/
[MISRA 2008] MISRA Limited. MISRA C++ 2008 Guidelines for the Use of the C++ Language in Critical Systems. ISBN 978-906400-03-3 (paperback); ISBN 978-906400-04-0 (PDF). June 2008.
http://www.misra.org.uk/
[MITRE 2007] MITRE. Common Weakness Enumeration, Draft 9. April 2008.
http://cwe.mitre.org
[MITRE 2008a] MITRE. CWE ID 327. Use of a Broken or Risky Cryptographic Algorithm. 2008.
http://cwe.mitre.org/data/definitions/327.html
[MITRE 2008b] MITRE. CWE ID 330. Use of Insufficiently Random Values. 2008.
[MITRE] MITRE. Common Weakness Enumeration, Version 1.8. February 2010.
[MSDN 2010] Microsoft Developer Network. CryptGenRandom Function. December 2016 [accessed].
[MDSN 2016] Microsoft Developer Network. nothrow (C++). December 2016 [accessed].
[NIST 2006] NIST. SAMATE Reference Dataset. 2006.
[Open Group 2013] The Open Group. The Open Group Base Specifications Issue 7, IEEE Std 1003.1, 2013 Edition. 2013.
[Open Group 2008] The Open Group. The Open Group Base Specifications Issue 7, IEEE Std 1003.1, 2008 Edition. 2008.
[Open Group 2004] The Open Group. The Open Group Base Specifications Issue 6, IEEE Std 1003.1, 2004 Edition. 2004.
[Plum 1991] Plum, Thomas. C++ Programming. Plum Hall, Inc. November 1991. ISBN 0911537104.
[Quinlan 2006] Quinlan, Dan; Vuduc, Richard; Panas, Thomas; Härdtlein, Jochen; & Sæbjørnsen, Andreas. Support for Whole-Program Analysis and the Verification of the One-Definition Rule in C++. 27-35. Page 500-262. In Proceedings of the Static Analysis Summit. July 2006.
[Rohlf 2009] Rohlf, Chris. Fun with erase (). 2009.
[Saks 1999] Saks, Dan. const T vs.T const. Embedded Systems Programming. February 1999. Pages 13-16.
[Saks 2007] Saks, Dan. Sequence Points. Embedded Systems Design. 2007.
[Seacord 2005] Seacord, Robert C. Secure Coding in C and C++. Addison-Wesley. 2005. ISBN 0321335724.
[Seacord 2013] Seacord, Robert C. Secure Coding in C and C++, Second Edition. Addison-Wesley. 2013.
[Sebor 2004] Sebor, Martin. C++ Standard Core Language Active Issues, Revision 68. 2010.
[SGI 2006] Silicon Graphics, Inc. basic_string. Standard Template Library Programmer's Guide. 2006.
[Steele 1977] Steele, G. L. Arithmetic shifting considered harmful. SIGPLAN Notices. Volume 12. Issue 11. November 1977. Pages 61-69.
[Stroustrup 1997] Stroustrup, Bjarne. The C++ Programming Language, Third Edition. Addison-Wesley. 1997. ISBN 978-0201700732.
[Stroustrup 2006] Stroustrup, Bjarne. C++ Style and Technique FAQ. 2006. December 2016 [accessed].
[Stroustrup 2001] Stroustrup, Bjarne. Exception Safety: Concepts and Techniques. AT&T Labs. 2001.
[Sun 1993] Sun Security Bulletin #00122. 1993.
[Sutter 2000] Sutter, Herb. Exceptional C++: 47 Engineering Puzzles, Programming Problems, and Solutions. Addison-Wesley Professional. 2000. ISBN 0201615622.
[Sutter 2001] Sutter, Herb. More Exceptional C++: 40 New Engineering Puzzles, Programming Problems, and Solutions. Addison-Wesley Professional. 2001. ISBN 020170434.
[Sutter 2004] Sutter, Herb & Alexandrescu, Andrei. C++ Coding Standards: 101 Rules, Guidelines, and Best Practices. Addison-Wesley Professional. 2004. ISBN 0321113586.
[van Sprundel 2006] van Sprundel, Ilja. Unusual bugs. 2006.
[Viega 2003] Viega, John & Messier, Matt. Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Networking, Input Validation & More. O'Reilly. 2003. ISBN 0-596-00394-3.
[Viega 2005] Viega, John. CLASP Reference Guide, Volume 1.1. Secure Software. 2005.
[VU#159523] Giobbi, Ryan. Vulnerability Note VU#159523. Adobe Flash Player integer overflow vulnerability. April 2008.
[VU#162289] Dougherty, Chad. Vulnerability Note VU#162289. GCC Silently Discards Some Wraparound Checks. April 2008.
[VU#623332] Mead, Robert. Vulnerability Note VU#623332. MIT Kerberos 5 contains double free vulnerability in "krb5_recvauth()" function. July 2005.
[VU#925211] Weimer, Florian. Vulnerability Note VU#925211. Debian and Ubuntu OpenSSL packages contain a predictable random number generator. May 2008.
[Warren 2002] Warren, Henry S. Hacker's Delight. Addison Wesley Professional. 2002. ISBN 0201914654.
[Williams 2010a] Williams, Anthony. Thread. Boost Library. 2010.
[Williams 2010b] Williams, Anthony. Simpler Multithreading in C++0x. Internet.com. 2010.
[xorl 2009] xorl. xorl %eax, %eax. December 2016 [accessed].
＜この記事は個人の過去の経験に基づく個人の感想です。現在所属する組織、業務とは関係がありません。＞
参考資料
参考文献一覧作成 ファイルの存在の確認とPDF・画像からの変換（OCR)
https://qiita.com/kaizen_nagoya/items/8edaf4ca410ef2ccdbc7
ISO/IEC TS 17961:2013 C Secure Coding Rules(1) All list(to be confirmed)
https://qiita.com/kaizen_nagoya/items/54e056195c4f11b850a1
Ethernet 記事一覧 Ethernet(0)
https://qiita.com/kaizen_nagoya/items/88d35e99f74aefc98794
Wireshark 一覧 wireshark(0)、Ethernet(48)
https://qiita.com/kaizen_nagoya/items/fbed841f61875c4731d0
線網（Wi-Fi）空中線(antenna)(0) 記事一覧(118/300目標)
https://qiita.com/kaizen_nagoya/items/5e5464ac2b24bd4cd001
OSEK OS設計の基礎 OSEK(100)
https://qiita.com/kaizen_nagoya/items/7528a22a14242d2d58a3
Error一覧(C/C++, python, bash...) Error(0)
https://qiita.com/kaizen_nagoya/items/48b6cbc8d68eae2c42b8
なぜdockerで機械学習するか 書籍・ソース一覧作成中 (目標100)
https://qiita.com/kaizen_nagoya/items/ddd12477544bf5ba85e2
言語処理100本ノックをdockerで。python覚えるのに最適。:10+12
https://qiita.com/kaizen_nagoya/items/7e7eb7c543e0c18438c4
プログラムちょい替え（0）一覧:4件
https://qiita.com/kaizen_nagoya/items/296d87ef4bfd516bc394
TOPPERSまとめ #名古屋のIoTは名古屋のOSで
https://qiita.com/kaizen_nagoya/items/9026c049cb0309b9d451
docker(0) 資料集
https://qiita.com/kaizen_nagoya/items/45699eefd62677f69c1d
Qiita-dockerお宝鑑定団
https://qiita.com/kaizen_nagoya/items/509e125263559b5aed5b
The C++ Standard Library: clang++とg++でコンパイルしてみた(まとめ):14件
https://qiita.com/kaizen_nagoya/items/9bdfaa392443d13e5759
C++17 - The Complete Guide clang++とg++でコンパイルしてみた(まとめ):4件
https://qiita.com/kaizen_nagoya/items/c000f307e642990781e1
C++N3242, 2011, ISO/IEC 14882, C++ standard(1) Example code compile list
https://qiita.com/kaizen_nagoya/items/685b5c1a2c17c1bf1318
C++N4606 Working Draft 2016, ISO/IEC 14882, C++ standard(1) Example code compile list
https://qiita.com/kaizen_nagoya/items/df5d62c35bd6ed1c3d43/
C++N4741, 2018 Standard Working Draft on ISO/IEC 14882 sample code compile list
https://qiita.com/kaizen_nagoya/items/3294c014044550896010
C++N4910:2022 Standard Working Draft on ISO/IEC 14882(0) sample code compile list
https://qiita.com/kaizen_nagoya/items/fc957ddddd402004bb91
Autosar Guidelines C++14 example code compile list(1-169)
https://qiita.com/kaizen_nagoya/items/8ccbf6675c3494d57a76
ISO/IEC TS 17961:2013 C Secure Coding Rules(1) All list(to be confirmed)
https://qiita.com/kaizen_nagoya/items/54e056195c4f11b850a1
プログラマによる、プログラマのための、統計と確率のプログラミングとその後 統計と確率一覧（０）
https://qiita.com/kaizen_nagoya/items/6e9897eb641268766909
一覧の一覧( The directory of directories of mine.) Qiita(100)
https://qiita.com/kaizen_nagoya/items/7eb0e006543886138f39
＜この記事は個人の過去の経験に基づく個人の感想です。現在所属する組織、業務とは関係がありません。＞
This article is an individual impression based on the individual's experience. It has nothing to do with the organization or business to which I currently belong.
文書履歴(document history)
ver. 0.01 初稿 1/4 20190710 午前
ver. 0.02 1/2 201908710 午後
ver. 0.03 参考資料追記 20211031
最後までおよみいただきありがとうございました。
いいね 💚、フォローをお願いします。
Thank you very much for reading to the last sentence.
Please press the like icon 💚 and follow me for your happy life.