C++ includes a large subset of the C language. As far as the C subset is used, the recommendations in apply.

For very large values of n, an expression like new T[n] can return a pointer to a heap region which is too small. In other words, not all array elements are actually backed with heap memory reserved to the array. Current GCC versions generate code that performs a computation of the form sizeof(T) * size_t(n) + cookie_size, where cookie_size is currently at most 8. This computation can overflow, and GCC-generated code does not detect this. The std::vector template can be used instead an explicit array allocation. (The GCC implementation detects overflow internally.) If there is no alternative to operator new[], code which allocates arrays with a variable length must check for overflow manually. For the new T[n] example, the size check could be n || (n > 0 && n > (size_t(-1) - 8) / sizeof(T)). (See .) If there are additional dimensions (which must be constants according to the C++ standard), these should be included as factors in the divisor. These countermeasures prevent out-of-bounds writes and potential code execution. Very large memory allocations can still lead to a denial of service. contains suggestions for mitigating this problem when processing untrusted data. See for array allocation advice for C-style memory allocation.

Do not overload functions with versions that have different security characteristics. For instance, do not implement a function strcat which works on std::string arguments. Similarly, do not name methods after such functions.

A stable binary interface (ABI) is vastly preferred for security updates. Without a stable ABI, all reverse dependencies need recompiling, which can be a lot of work and could even be impossible in some cases. Ideally, a security update only updates a single dynamic shared object, and is picked up automatically after restarting affected processes. Outside of extremely performance-critical code, you should ensure that a wide range of changes is possible without breaking ABI. Some very basic guidelines are: Avoid inline functions. Use the pointer-to-implementation idiom. Try to avoid templates. Use them if the increased type safety provides a benefit to the programmer. Move security-critical code out of templated code, so that it can be patched in a central place if necessary. The KDE project publishes a document with more extensive guidelines on ABI-preserving changes to C++ code, Policies/Binary Compatibility Issues With C++ (d-pointer refers to the pointer-to-implementation idiom).

GCC offers different language compatibility modes: -std=c++98 for the original 1998 C++ standard -std=c++03 for the 1998 standard with the changes from the TR1 technical report -std=c++11 for the 2011 C++ standard. This option should not be used. -std=c++0x for several different versions of C++11 support in development, depending on the GCC version. This option should not be used. For each of these flags, there are variants which also enable GNU extensions (mostly language features also found in C99 or C11): -std=gnu++98, -std=gnu++03, -std=gnu++11. Again, -std=gnu++11 should not be used. If you enable C++11 support, the ABI of the standard C++ library libstdc++ will change in subtle ways. Currently, no C++ libraries are compiled in C++11 mode, so if you compile your code in C++11 mode, it will be incompatible with the rest of the system. Unfortunately, this is also the case if you do not use any C++11 features. Currently, there is no safe way to enable C++11 mode (except for freestanding applications). The meaning of C++0X mode changed from GCC release to GCC release. Earlier versions were still ABI-compatible with C++98 mode, but in the most recent versions, switching to C++0X mode activates C++11 support, with its compatibility problems. Some C++11 features (or approximations thereof) are available with TR1 support, that is, with -std=c++03 or -std=gnu++03 and in the <tr1/*> header files. This includes std::tr1::shared_ptr (from <tr1/memory>) and std::tr1::function (from <tr1/functional>). For other C++11 features, the Boost C++ library contains replacements.