C C23

Use these rules for C23 code that processes untrusted data, crosses system boundaries, or runs with meaningful privileges.

Object bounds and memory access

• Carry buffer capacity with every pointer and validate offsets and lengths before pointer arithmetic.
• Prefer arrays with compile-time bounds and APIs that accept an explicit destination size.
• Reject indexes before dereferencing and account for the full element size when computing byte ranges.
• Do not form, compare, or dereference pointers outside an object's lifetime; keep pointer arithmetic within the same array or one past it, never dereference one-past pointers, and avoid relational comparisons between unrelated objects.
• Treat flexible array members, packed layouts, unions, and manual object representations as reviewed trust-boundary code.

Integer and size safety

• Validate signedness, range, and units before converting external integers to size_t, pointer differences, or narrower types.
• Check addition, subtraction, multiplication, shifts, and negation for overflow before using results as sizes or offsets.
• Compute sizes, offsets, and counts with C23 <stdckdint.h> ckd_add, ckd_sub, and ckd_mul (GCC 14+, Clang 18+) and reject the input whenever they return true. Where <stdckdint.h> is unavailable, use __builtin_add_overflow-family intrinsics or a reviewed checked-arithmetic helper that tests operands before the operation, and never detect overflow after the fact with expressions such as a + b < a on signed or pointer operands.
• Reject negative lengths before any implicit