C/C++ application logger library that is easy to use, robust, fail-safe and reliable

The primary benefit using this fail-safe C-Program API library over other application loggers, is that it does extensive runtime validation to prevent the application from crashing due to common programmers printf() style pitfalls or unpredictable execution segmentation faults. (e.g., string type %s using NULL, 0 or negative value).

During runtime, the API decode, analyze and apply 18 different Bound Parameter verification techniques (https://github.com/wandi-ssal/fail-safe-application-logger/blob/main/WandiSSAL-Bound-Capabilities.pdf) to ensure log messages are used accurately, fail-safe and reliable. If a runtime validation fails the API generates an error code and simple returns, allowing the application to continue normal processing (no need for the application to check/stop processing). In addition, the library was designed and implemented using secure coding practices and techniques. It was further tested with Common Weakness Enumeration (CWE) security scanning tools to identify CWE vulnerabilities and weaknesses applicable to the library codebase. Based on those finding the codebase was enhanced to incorporate CWE recommended solutions to reduce security risks and increase software reliability. This includes but not limited to the following CWEs:

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’).
  • CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’).
  • CWE-134: Use of Externally-Controlled Format String.
  • CWE-126: Buffer Over-read.
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
  • CWE-190: Integer Overflow or Wraparound.
  • CWE-787: Out-of-bounds Write.
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
  • CWE-20: Improper Input Validation.
  • CWE-284: Improper Access Control.
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
  • CWE-770: Allocation of Resources Without Limits or Throttling.

API example: Provides a simple printf() style function interface commonly used to generate application log messages:

WandiSSAL_LoggerAppsMsg( DevProd, LogicalName, SeverityLevel, “Format string specification, string specifier value %s”,  ”string value” );
  1. DevProd controls generating development and/or production log messages.
  2. LogicalName indicates file name, function name or common name across multiple files.
  3. SeverityLevel indicates different levels of severity importance.
  4. The remainder of the arguments are similar to printf() style specification.
  5. Uses runtime Bound Parameter validations  to ensure fail-safe application execution:
    • Use only LogicalName defined for use by the API.
    • Use only SeverityLevel defined for use by the API.
    • Decode printf() format string specification for string specifiers and match to corresponding log message arguments.
    • Validate length of format string specification to prevent use of unbounded strings.
    • Validate length of string argument to prevent the use of improper NULL terminated strings.
    • Validate specific ASCII characters to avoid use of non-printable characters in log message.
    • Validate against an acceptable set of format string specifiers to prevent unsafe and malicious use of attacker string specifiers.
    • Validate LogicalName and SeverityLevel for supported values.
    • Prevent use of invalid NULL, 0, negative values for %s format string specifier.
    • Block the use of untrusted or malicious format string specifiers.
    • Block the use of ill-formed or non-standard format specifiers.
    • When API fails validation, it generates a status code and safely returns.
    • Application does not need to check API return status.
  6. Enable or disable log message processing and generation.

API example log file name: [pid_date_timestamp_sequence-number.log]: 3550_09012026_17:14:20_001.log

API example output log file content format: 02/09/2026 12:01:55 [3650:sample_program] [DATABASE] [INFO] Message that generates 1 string and 2 integer arguments [String Argument], [98] and [99]

where: “02/09/2026 12:01:55” date and timestamp when the log message was generated. “[3650:sample_program]” application process id and name. “[DATABASE]” logical message group for related application log messages. “[INFO]” severity for log message.   The remainder of the output is derived from the C-Programming Language printf() format string specification and corresponding arguments.

This free library is part of the Secure Application Logger Framework (https://istech.com ) to provide a viable secure solution (that existing tools does not provide) to protect application log message sensitive data (1) while the code is being developed, (2) stored in executable file on disk (3) and while the application process is running: https://github.com/wandi-ssal/fail-safe-application-logger/blob/main/Advanced-Logging-Capabilities.pdf  

Downloads and documentations: https://github.com/wandi-ssal/fail-safe-application-logger

contact: bwoodley@istech.com