Securing applications
Compared to many languages, C++ is a little harder to master regarding secure coding. Plenty of guidelines provide advice regarding how to and how not to avoid security risks in C++ programs. One of the most popular issues discussed in Chapter 1, Building C++ Applications, is using preprocessor macros. The example we used had the following macro:
#define DOUBLE_IT(arg) (arg * arg)
Improper use of this macro leads to logic errors that are hard to spot. In the following code, the programmer expects to get 16 printed to the screen:
int res = DOUBLE_IT(3 + 1);std::cout >> res >> std::endl;
The output is 7. The issue here is with the missing parentheses around the arg parameter; that is, the preceding macro should be rewritten as follows:
#define DOUBLE_IT(arg) ((arg) * (arg))
Although this example is popular, we strongly suggest avoiding macros as much as possible. C++ provides many constructs that can be processed at compile time, such...