Bibliography and sources

Gathered here are the works this book leans on and the sources of the incidents given as cases in the body. How to obtain the standard document is in appendix D.

Standard documents#

• ISO/IEC 9899:2024 (C23) — this book’s criterion standard. The widely referenced free document is N3220, but that is a working draft issued just after C23 (see appendix D).
• ISO/IEC 9899:2018 (C17), 9899:2011 (C11), 9899:1999 (C99), 9899:1990 (C89/C90) — for checking back through the editions. Drafts N2176, N1570, N1256.
• IEEE 754 — the standard for floating-point arithmetic (the ground of chapters 7 and 52). This book does not pin an edition; it cites only the formats in use (binary32, binary64) and the rules.
• The Unicode Standard — character sets, encodings and normalisation (chapter 8). Its version rises every year, so when the property of a single character is the ground of an argument, give the version you consulted.
• POSIX (IEEE Std 1003.1) — the system interfaces outside standard C (the background of chapter 98).

The language’s history#

• Dennis M. Ritchie, “The Development of the C Language” (1993) — the founder’s account of the CPL→BCPL→B→C lineage and the early design decisions (chapters 2 and 13).
• Brian W. Kernighan and Dennis M. Ritchie, The C Programming Language (1978, 1988) — the so-called K&R. The reference point dividing before C89 from after.
• The WG14 document repository (open-std.org) — proposals and defect reports. The primary source for “why did this clause end up like this”.

Citation format#

The references under “The events this book cites” below follow the ACM Reference Format, the same convention stated in appendix D.

The two lists above it — “Standards documents” and “The history of the language” — are set differently, because they are not bibliographic entries but lists of identifiers. A standard is named by issuing body, number, and edition; that is the convention, and it is easier to look up. When citing one, always give the edition: the same “IEEE 754” has different clauses in different editions.

Kind of source	Order of the fields
book	Author. Year. Title (edition). Publisher, place. ISBN.
conference paper	Author. Year. Paper title. In Proceedings title. Publisher, place. URL.
technical report	Author. Year. Title. Report number, institution, place. URL.
specification	Issuing body. Year. Title (edition, number).
advisory / CVE	Identifier. Year. Issuing body. URL.
online article or mail	Author. Year. Title. Medium, date. URL.

Table 105.1 — The order in which sources are written

Three rules are kept. The year is the year of that edition; the URL is a primary source wherever possible (put up by the issuing body itself); and the footnote in the text and this list name the same source. The parenthesis at the end of each entry gives the chapters that cite it.

The incidents this book cites#

Primary sources for the incidents told as stories in the text. The same source is footnoted at the place concerned.

• ARIANE 5 Flight 501 Failure: Report by the Inquiry Board. 1996. European Space Agency / CNES, Paris. sci.esa.int/web/cluster/-/38889-ariane-501-report-by-board-of-inquiry — an overflow while converting a 64-bit float to a 16-bit integer stopped the guidance system. The press release is at esa.int. (chapter 30)

• CVE-2014-1266. 2014. National Vulnerability Database, NIST. nvd.nist.gov/vuln/detail/CVE-2014-1266 — Apple Secure Transport’s “goto fail”. One statement written twice under a braceless if skipped signature verification entirely. (chapter 32)

• Eugene H. Spafford. 1988. The Internet Worm Program: An Analysis. Technical Report CSD-TR-823, Purdue University, West Lafayette, IN. spaf.cerias.purdue.edu/tech-reps/823.pdf — the primary analysis of the worm’s routes, reconstructed by decompilation. The gets overflow in fingerd was one of them. (chapters 43 and 69)

• Tim Newsham. 2000. Format String Attacks. White paper, Guardent, Inc. faculty.digipen.edu/~dvolper/copies/tn-usfs.pdf — the early paper that organised format-string vulnerabilities into a class. The class itself is catalogued as CWE-134 (cwe.mitre.org/data/definitions/134.html). (chapters 66 and 69)

• Scott A. Crosby and Dan S. Wallach. 2003. Denial of Service via Algorithmic Complexity Attacks. In Proceedings of the 12th USENIX Security Symposium. USENIX Association, Washington, DC. usenix.org/conference/12th-usenix-security-symposium/… — stopping a service by deliberately building a data structure’s worst case. The theoretical root of the 2011 hash-collision attacks on several web frameworks. (chapters 90 and 97)

• DSA-1571-1 openssl — predictable random number generator (CVE-2008-0166). 2008. Debian Security Advisory, 2008-05-13. lists.debian.org/debian-security-announce/2008/msg00152.html — one line changed by a distribution narrowed the entropy source, making every key generated for nearly two years predictable. The tracker entry is at security-tracker.debian.org/tracker/DSA-1571-1. (chapter 98)

• Kees Cook. 2018. VLA removal for v4.20-rc1. Linux kernel mailing list, 2018-10-28. lkml.iu.edu/hypermail/linux/kernel/1810.3/02834.html — where the kernel finished removing variable-length arrays and turned on -Wvla globally. For the background see Jonathan Corbet. 2018. Variable-length arrays and the max() mess. LWN.net (lwn.net/Articles/749064/). (chapter 39)

• Linux kernel top-level Makefile. git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Makefile — the primary place to confirm that the kernel is still built with -fno-strict-aliasing. (chapters 14 and 18)

• Mike Jones. 1997. What really happened on Mars? Includes the account of Glenn Reeves (JPL). cs.cornell.edu/courses/cs614/1999sp/papers/pathfinder.html — Pathfinder’s repeated resets were priority inversion, fixed by turning on the priority inheritance that had been left off. (chapter 85)

• Salvatore Dipietro. 2026. [PATCH 0/1] sched: Restore PREEMPT_NONE as default. Linux kernel mailing list, 2026-04-03. spinics.net/lists/kernel/msg6138481.html — the report of PostgreSQL throughput falling to 0.51x on Linux 7.0. The analysis is Jonathan Corbet. 2026. The 7.0 scheduler regression that wasn’t. LWN.net (lwn.net/Articles/1067029). (chapters 85 and 101)

• SQLite. How SQLite Is Tested. sqlite.org/testing.html — the amount of test code against the library and the four test harnesses. The distribution form is sqlite.org/amalgamation.html. (chapters 91 and 102)

Machine architecture and the stack#

The sources behind chapter 5′s section “How far this sketch holds”.

• ISO/IEC 9899:2024 (C23) §6.5.3.3 p9 — the clause that recursive calls shall be permitted. That the words stack and heap never occur in the standard was checked mechanically over the whole of the widely referenced working draft (N3220, 759 pages). (chapter 5)
• Microchip. MPLAB XC8 C Compiler User’s Guide for PIC MCU (DS50002737). — the compiled stack (statically allocated), non-reentrant functions, and why no stack guidance is possible when recursion is used. (chapter 5)
• Microchip. 8-bit PIC MCU family documentation — the depth of the hardware stack (eight levels mid-range, sixteen enhanced mid-range) and that it holds return addresses only. (chapter 5)

Radix and ternary computers#

The sources behind chapter 2′s “radix economy” and the account of Setun.

• Development of ternary computers at Moscow State University. Russian Virtual Computer Museum. computer-museum.ru/english/setun.htm — the primary record of Setun’s development, the fifty machines produced, the tryte, and why production stopped. (chapter 2)
• Donald E. Knuth. 1997. The Art of Computer Programming, Volume 2: Seminumerical Algorithms (3rd ed.). Addison-Wesley, Reading, MA. §4.1. — positional number systems and balanced ternary (“perhaps the prettiest number system of all”). (chapter 2)
• A 2024 study of carbon-nanotube ternary logic in Science Advances. science.org/doi/10.1126/sciadv.adt1909 — a device switching reliably among three states. ★ The text states that this is a research result, not a product. (chapter 2)

Books this book borrowed concepts from#

Below are works from which particular passages of this book took their seed. Each is named again in a footnote at the place concerned. No sentences, tables or examples were carried over; the exposition and the measurements are this book’s own.

• Peter van der Linden. 1994. Expert C Programming: Deep C Secrets. Prentice Hall, Englewood Cliffs, NJ. ISBN 0-13-177429-8.

  • Korean edition: 페터르 판데르린던. 2022. 컴파일러 개발자가 들려주는 C 이야기 (trans. 정기훈). Insight, Seoul. ISBN 978-89-6626-342-4. — the edition this book worked from. The Korean title departs considerably from the original.
  • Chapter 65 — calling the alternating right-left way of reading declarations “boustrophedon”, compressing that procedure into a precedence rule (in particular the clause splitting where const/volatile attaches), and the three rules of thumb for typedef.
  • Chapter 41 — the diagnosis that the learning path hardens the “an array is a pointer” misunderstanding, the seed of contrasting arrays and pointers axis by axis, the point that parameter conversion happens one layer only, and the manner of stating the limit on passing arbitrary multidimensional arrays.
  • Chapter 56 — separating the three stages of linking by name, and presenting interpositioning as a C programmer’s problem.
  • This book’s assessment: being a 1994 book it does not reflect the changes since C99. Each passage above was therefore updated against today’s standard and by measurement, and where it has drifted the text says so.

Working with bits#

The idioms in chapter 51 were written fresh for this book and checked on this machine, but the techniques themselves are long-shared property. For readers who want to go deeper, here is where they live.

• Henry S. Warren, Jr. 2012. Hacker’s Delight, 2nd ed. Addison-Wesley. ISBN 978-0-321-84268-8. — the standard collection of bit and integer tricks, with proofs.
• Sean Eron Anderson. Bit Twiddling Hacks. Stanford University (web document). — a widely cited list of short idioms.
• Donald E. Knuth. 2011. The Art of Computer Programming, Volume 4A: Combinatorial Algorithms, Part 1. Addison-Wesley. §7.1 — the theory behind bitwise operations and Boolean functions.
• ISO/IEC 9899:2024 §7.18 <stdbit.h> — the primary source for the bit functions C23 standardised, including __STDC_ENDIAN_NATIVE__.

Linking, loading, the ABI#

The sources chapter 56′s account of linking rests on.

• John R. Levine. 1999. Linkers and Loaders. Morgan Kaufmann, San Francisco, CA. ISBN 1-55860-496-0. — the standard account of link-editing, loading and runtime linking.
• Ulrich Drepper. 2011. How To Write Shared Libraries. (technical paper, revised) — GOT, PLT, symbol lookup order and lazy binding from an implementer’s view.
• System V Application Binary Interface — AMD64 Architecture Processor Supplement. — the calling convention and ELF’s relocation formats. The primary source for “what an ABI fixes”.
• Tool Interface Standard (TIS), Executable and Linking Format (ELF) Specification, v1.2. 1995. — definitions of segments, sections and the dynamic section.
• The ld.so(8), ld(1) and dlopen(3) manual pages — the exact meanings of LD_BIND_NOW, LD_PRELOAD, -z now, -z relro and --as-needed.
• The code-generation option sections of the GCC and Clang manuals — -fPIC/-fpic, -shared, -static, -fno-semantic-interposition.

Tools and libraries#

• The official documentation of GCC and Clang/LLVM — warning options, sanitizers, extensions (chapter 18).
• The GDB and LLDB documentation — debuggers (chapter 18).
• The proven C library — the subject of this book’s Part XII. This book describes the v26.07.23d snapshot and verified its examples with that edition.
• cppreference.com — the practical reference for the standard library.

This book’s verification environment#

Every execution result printed in the body was really obtained in the following environment.

• Compilation: -std=c23 -Wall -Wextra -Werror
• Reference compiler: GCC 14 (x86-64 Linux)
• Cross-checking: Clang 22
• Debugger session captures: GDB 17.2
• Typesetting: Typst 0.15.1