A theory for decades of C vulnerabilities