Course

Unit 1

Syllabus Introduction – Gauging the threat – Security concepts – SetUID Programs. Strings – Common String Manipulation errors – Improperly Bounded String Copies – Off-by-One Errors – Null Termination Errors – String Truncation – String Errors without Functions – String vulnerabilities – Buffer Overflow – Process memory organization – Stack management – Stack smashing – Mitigation techniques – String handling functions – Runtime protection strategies.

Unit 2

Dynamic Memory Management – C Memory management functions – Common C Memory Management Errors – Initialization Errors – Failing to Check Return Values – Dereferencing Null or Invalid Pointers – Referencing Freed Memory – Freeing Memory Multiple Times – Memory Leaks – Zero-Length Allocations – Mitigation Strategies. Integer Security –Introduction to integer types – Integer Data Types – Integer Conversions – Integer operations – Integer Vulnerabilities – Mitigation strategies.

Unit 3

Formatted Output – Variadic Functions – Formatted Output Functions – Vulnerabilities – Mitigation Strategies. Concurrency – Common Errors – Race Conditions – File I/O – TOCTOU – Mitigation strategies.

Pre-Requisite(s): 23CCE103 Computer Programming

Course Objectives

• This course facilitates learning various techniques for systems and applications programmers to write code securely. 
• to explore FOR vulnerabilities in code and mitigate.  

Course Outcomes

• CO1: Understand the common security threats in software applications.
• CO2: Identify and mitigate the vulnerabilities due to string manipulation errors.
• CO3: Identify and mitigate the vulnerabilities based on dynamic memory management errors and integer operations.
• CO4: Identify and mitigate the vulnerabilities due to errors in formatted output functions and concurrency.

CO-PO Mapping

Textbooks

1. SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems, Software Engineering Institute, Carnegie Mellon University, 2016 
2. Robert C. Seacord, Secure Coding in C and C++, 2nd Edition, Addison-Wesley, 2013.

References

Wenliang Du, Computer Security – A hands-on Approach, Second Edition, Create space Independent Pub; 2019.