Secure C Programming: Week #3

• Introduction to Programming C, EEF110E, Week #3

Secure C Programming

• When displaying a string that ends with a newline, use the puts function.
• The puts function displays the string argument follows by a newline character.
• printf( "Welcome to C!\n" ); should be written as puts("Welcome to C!" );
• The puts() function prints a string to the console.
• The printf() function prints a variety of data types, including formatted strings.
• printf() is more powerful, more complex, and more prone to errors.
• A programmer could accidentally specify an incorrect format string when using the printf() function.
• This could lead to the function attempting to print data to an invalid location, potentially crashing the program or allowing an attacker to execute arbitrary code.
• The puts() function doesn't require a format string, making it less prone to errors and more secure.

Pseudocode & Algorithms

• Pseudocode is an artificial and informal language that helps develop algorithms.
• Pseudocode is useful for developing algorithms that will be converted to structured C programs, and convenient and user-friendly.
• Pseudocode is not an actual computer programming language.
• The solution to any computing problem involves executing a series of actions in a specific order.
• A procedure for solving a problem involves the actions to be executed, and the order in which these actions are to be executed, which is called an algorithm

Control Structures

• Ordinarily, statements in a program are executed sequentially, i.e. in the order in which they are written.
• Bohm and Jacopini's work demonstrated that all programs could be written using just three control structures: the sequence structure, the selection structure, and the iteration structure.

Flowcharts

• A flowchart is a graphical representation of an algorithm or a portion of one.
• Flowcharts use special-purpose symbols like rectangles, diamonds, rounded rectangles, and small circles, connected by arrows called flowlines

Decision Making

• This section introduces the simple version of C's if statement.
• The if statement allows a program to make a decision based on the truth or falsity of a statement of fact called a condition.
• If the condition in an if statement is true, then the statement in the body of the if statement is executed.
• Whether the body statement is executed or not, after the if statement completes, execution proceeds with the next statement after the if statement.

C if Statement

• Syntax of the if statement:

if (test expression) {
    // code
}

• The if statement evaluates the test expression inside the parentheses ().
• If the test expression is evaluated to true, statements inside the body of if are executed.
• If the test expression is evaluated to false, statements inside the body of if are not executed.

The if Selection Statement

• Selection statements are used to choose among alternative courses of action.
• If student's grade is greater than or equal to 60; Print "Passed".
• The preceding pseudocode of an if statement may be written in C as follows:

if (grade >= 60) {
    puts("Passed");
} // end if

The if...else Selection Statement

• The if selection statement performs an action only if the condition is true; otherwise, the action is skipped.
• The if...else selection statement allows different actions to be performed based on whether the condition is true or false.
• If student's grade is greater than or equal to 60; Print "Passed"
• Else; Print "Failed" prints Passed if the student's grade is greater than or equal to 60, and Failed if the student's grade is less than 60.

C if...else Statement

• The if statement may have an optional else block.
• The syntax of the if...else statement is:

if (test expression) {
    // run code if test expression is true
} else {
    // run code if test expression is false
}

• The corresponding If...else can be written in C as follows:

if (grade >= 60) {
    puts("Passed");
} // end if
else {
  puts("Failed");
} // end else