Secure Coding Practices for Embedded

/* Memory safety patterns for automotive embedded C */
/* MISRA C:2012 Rule 18.1: no out-of-bounds pointer arithmetic    */
/* MISRA C:2012 Rule 21.3: no dynamic memory allocation           */
/* SEI CERT C STR31-C: ensure buffers are large enough            */
/* SEI CERT C INT30-C: detect unsigned integer overflow           */

#include 
#include 

/* BAD: no bounds check -- buffer overflow if src > 63 bytes */
void bad_copy(const char* src) {
    char buf[64];
    strcpy(buf, src);  /* MISRA violation + potential overflow */
}

/* GOOD: explicit length-pair pattern */
void safe_copy(const uint8_t* src, size_t src_len, uint8_t* dst, size_t dst_size) {
    if (src_len >= dst_size) return;  /* reject oversized input */
    memcpy(dst, src, src_len);
    dst[src_len] = 0;
}

/* Safe unsigned addition with overflow detection */
uint16_t safe_add_u16(uint16_t a, uint16_t b) {
    if (b > (UINT16_MAX - a)) return UINT16_MAX;  /* saturate on overflow */
    return (uint16_t)(a + b);
}

/* Static memory pool instead of malloc (MISRA Rule 21.3) */
typedef struct { uint8_t data[256]; uint8_t used; } Block;
static Block pool[16];

Block* Pool_Alloc(void) {
    for (int i = 0; i < 16; i++) {
        if (!pool[i].used) { pool[i].used = 1; return &pool[i]; }
    }
    return NULL;  /* pool exhausted; caller handles error */
}

/* Constant-time comparison for MAC verification */
/* NEVER use memcmp() for MAC comparison:
   memcmp short-circuits on first mismatch → timing oracle attack
   Example: attacker sends 10,000 probes; measures response time
   → can determine correct byte-by-byte → recover 32-byte key in ~8000 attempts */

#include 

/* Always iterates all bytes; execution time identical regardless of match point */
int ct_equal_32(const uint8_t* a, const uint8_t* b) {
    uint8_t diff = 0;
    for (int i = 0; i < 32; i++) diff |= a[i] ^ b[i];
    return (diff == 0);
}

/* In production code: use AUTOSAR Csm_MacVerify() which uses constant-time internally.
   Never implement your own MAC verification with memcmp().
   This has been exploited in deployed automotive ECUs to recover HMAC secrets. */