ISO/IEC TR 24772-3:2020 PDF

Overview

ISO/IEC TR 24772-3:2020 - Programming languages - Guidance to avoiding vulnerabilities in programming languages - Part 3: C - is a technical report that identifies common software programming language vulnerabilities and describes how they are manifested or avoided in the C language. The document targets development of systems requiring assured behaviour for security, safety, mission-critical, and business‑critical software, and is applicable to software developed, reviewed, or maintained for any application.

Key topics

The standard organizes practical guidance by language concept and specific classes of vulnerability. Major topics covered include:

• Language concepts and applicability of vulnerabilities to C
• Type system, bit representations, and floating‑point concerns
• Common errors: conversion errors, string termination, buffer boundary violations (buffer overflows), unchecked array indexing/copying
• Pointer issues: pointer type conversions, pointer arithmetic, null pointer dereference, dangling heap/stack references
• Arithmetic and operator pitfalls: wrap‑around errors, improper use of shift operations, operator precedence, and side‑effects/order of evaluation
• Code quality and maintainability: dead stores, unused variables, identifier reuse, namespace issues, initialization of variables, dead/deactivated code
• Control flow and structure: switch statements and static analysis, loop control variables, off‑by‑one errors, demarcation of control flow, passing parameters and return values, subprogram signature mismatch

Each topic includes an assessment of applicability to C and guidance to language users, enabling targeted mitigation strategies.

Applications and who should use it

ISO/IEC TR 24772-3:2020 is practical for:

• C developers building secure, safety‑critical or high‑assurance software
• Software architects designing systems with strict reliability requirements
• Code reviewers and auditors creating secure coding checklists
• Static analysis and tool vendors mapping checker rules to recognized vulnerabilities
• Systems integrators and procurement teams specifying secure‑coding expectations
• Trainers and educators teaching secure C programming and defensive coding practices

Use cases include integrating the guidance into secure coding standards, code review templates, static analysis rule sets, and training curricula to reduce vulnerabilities in C codebases.

Related standards

• ISO/IEC TR 24772-1 (reference list of vulnerabilities) - the part that enumerates the vulnerability classes the C-specific guidance addresses.
• Other language‑specific parts of the ISO/IEC TR 24772 series provide analogous guidance for other programming languages.

Keywords: ISO/IEC TR 24772-3:2020, secure C programming, programming language vulnerabilities, buffer overflow, null pointer dereference, static analysis, safety-critical software, secure coding guidance.