From e44c92bcf993760217c06b3b53901216a6657510 Mon Sep 17 00:00:00 2001 From: Jason Turner Date: Wed, 28 Sep 2016 13:26:25 -0600 Subject: [PATCH] Add reference to discussion on variadic functions Closes #53 --- 04-Considering_Safety.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/04-Considering_Safety.md b/04-Considering_Safety.md index 68028c0..9d6715c 100644 --- a/04-Considering_Safety.md +++ b/04-Considering_Safety.md @@ -138,6 +138,8 @@ But consider refactoring of program logic (for example, additional checking on o Variadic functions can accept a variable number of parameters. The probably best known example is printf(). You have the possibility to define this kind of functions by yourself but this is a possible security risk. The usage of variadic functions is not type safe and the wrong input parameters can cause a program termination with an undefined behavior. This undefined behavior can be exploited to a security problem. If you have the possibility to use a compiler that supports C++11, you can use variadic templates instead. +[It is technically possible to make typesafe C-style variadic functions with some compilers](https://github.com/lefticus/cppbestpractices/issues/53) + ## Additional Resources [How to Prevent The Next Heartbleed](http://www.dwheeler.com/essays/heartbleed.html) by David Wheeler is a good analysis of the current state of code safety and how to ensure safe code.