Secure coding - Wikipedia (FazBrowse)

#include<string.h> #define SMALL 50 voidvulnerable_function(char*large_user_input){ chardst[SMALL]; strcpy(dst,large_user_input); }

If the user input is larger than the destination buffer, a buffer overflow will occur.

To fix this unsafe program, use strncpy to prevent a possible buffer overflow.

\n\n#define BUF_SIZE 100\n\nvoid secure_function(char* user_input) {\n char dst[BUF_SIZE];\n // copy a maximum of BUF_SIZE bytes\n strncpy(dst, user_input, BUF_SIZE);\n // set the last character in the buffer to NUL.\n dst[BUF_SIZE - 1] = '\\0';\n}\n"}}'>#include<string.h> #define BUF_SIZE 100 voidsecure_function(char*user_input){ chardst[BUF_SIZE]; // copy a maximum of BUF_SIZE bytes strncpy(dst,user_input,BUF_SIZE); // set the last character in the buffer to NUL. dst[BUF_SIZE-1]='\0'; }

Another secure alternative is to dynamically allocate memory on the heap using malloc.

\n#include <string.h>\n\nchar* secure_copy(char* src) {\n size_t len = strlen(src);\n char* dst = (char*)malloc(len + 1);\n if (dst) {\n strncpy(dst, src, len);\n // append null terminator \n dst[len] = '\\0';\n }\n return dst;\n}\n"}}'>#include<stdlib.h> #include<string.h> char*secure_copy(char*src){ size_tlen=strlen(src); char*dst=(char*)malloc(len+1); if(dst){ strncpy(dst,src,len); // append null terminator dst[len]='\0'; } returndst; }

In the above code snippet, the program attempts to copy the contents of src into dst, while also checking the return value of malloc() to ensure that enough memory was able to be allocated for the destination buffer.

Format-string attack prevention

edit

A Format String Attack is when a malicious user supplies specific inputs that will eventually be entered as an argument to a function that performs formatting, such as printf(). The attack involves the adversary reading from or writing to the stack.

The C printf function writes output to stdout. If the parameter of the printf function is not properly formatted, several security bugs can be introduced. Below is a program that is vulnerable to a format string attack.

\n\nvoid vulnerable_print(char* malicious_input) {\n\tprintf(malicious_input);\n}\n"}}'>#include<stdio.h> voidvulnerable_print(char*malicious_input){ printf(malicious_input); }

A malicious argument passed to the program could be "%s%s%s%s%s%s%s", which can crash the program from improper memory reads.

Integer-overflow prevention

edit

Integer overflow occurs when an arithmetic operation results in an integer too large to be represented within the available space. A program which does not properly check for integer overflow introduces potential software bugs and exploits.

Below is a function in C++ which attempts to confirm that the sum of x and y is less than or equal to a defined value MAX: