1
Software security; Common implementation flaws;
Principles
Dawn Song
2
Another Vulnerability
•char buf[80];
void vulnerable() {
int len = read_int_from_network();
char *p = read_string_from_network();
if (len > sizeof buf) {
error("length too large, nice try!");
return;
}
memcpy(buf, p, len);
}
•What's wrong with this code?
•Hint – memcpy() prototype:
–void *memcpy(void *dest, const void *src, size_t n);
•Definition of size_t: typedef unsigned int size_t;
•Do you see it now?
3
Implicit Casting Bug
•Attacker provides a negative value for len
–if won’t notice anything wrong
–Execute memcpy() with negative third arg
–Third arg is implicitly cast to an unsigned int, and
becomes a very large positive int
–memcpy() copies huge amount of memory into buf,
yielding a buffer overrun!
•A signed/unsigned or an implicit casting bug
–Very nasty – hard to spot
•C compiler doesn’t warn about type mismatch
between signed int and unsigned int
–Silently inserts an implicit cast
