Introspection for C and its Applications to Library Robustness
Listing 3 Example usage of variadic functions, taken from the PHP Zend Engine
1 s t a t ic void xbuf_format_converter ( void *xbuf , const char *fmt , va_li s t ap) {
2 char * s = NULL ;
3 size_t s_len ;
4 while (* fmt ) {
5 i f (* fmt != '%' ) {
6 INS_CHAR ( xbuf , *fmt ) ;
7 } else {
8 fmt ++ ;
9 switch (* fmt ) {
10 // . . .
11 case ' s ' :
12 s = va_arg (ap , char *) ;
13 s_len = strlen ( s ) ;
14 break ;
15 // . . .
16 }
17 INS_STRING ( xbuf , s , s_len ) ;
18 }
19 }
20 }
Listing 4 Example of type confusion
1 int apply ( in t * arr , size_t n , int f ( int arg1 ) ) {
2 i f ( f == NULL) return -1 ;
3 for ( size_t i = 0; i < n ; i ++)
4 arr [ i ] = f ( arr [ i ] ) ;
5 return 0;
6 }
7
8 double square ( int a) { return a * a ; }
9
10 apply ( arr , 5 , square ) ;
calling a function pointer, since objects have no types attached that could be used for
validation.
Unterminated strings.
Unterminated strings are a problem, since the string functions
of libc (and sometimes also application code) rely on strings ending with a ‘\0’ (null
terminator) character. However, C standard library functions that operate on strings
lack a common convention on whether to add a null terminator [28]. Additionally, it
is not possible to verify whether a string is properly terminated without potentially
causing buffer overreads. Listing 5 shows an example of an unterminated string
vulnerability. The read function reads a file’s contents into a string inputbuf. After the
call, inputbuf is unterminated if the file was unterminated or if MAXLEN was exceeded.
This is likely to cause an out-of-bounds write in strcpy(), since it copies characters to
buf until a null terminator occurs. Recent similar real-world vulnerabilities include
CVE-2016-7449, where strlcpy() was used to copy untrusted (potentially unterminated)
input in GraphicsMagick. Further examples are CVE-2016-5093 and CVE-2016-0055,
where strings were not properly terminated in the PHP Zend Engine as well as in
Internet Explorer and Microsoft Office Excel [27].
Unsafe functions.
Some functions in common libraries such as libc have been designed
such that they “can never be guaranteed to work safely” [2, 12]. The most prominent
4:6
剩余30页未读，继续阅读
weixin_38737144
- 粉丝: 4
- 资源: 942
我的内容管理
展开
最新资源
- 多模态联合稀疏表示在视频目标跟踪中的应用
- Kubernetes资源管控与Gardener开源软件实践解析
- MPI集群监控与负载平衡策略
- 自动化PHP安全漏洞检测：静态代码分析与数据流方法
- 青苔数据CEO程永：技术生态与阿里云开放创新
- 制造业转型： HyperX引领企业上云策略
- 赵维五分享：航空工业电子采购上云实战与运维策略
- 单片机控制的LED点阵显示屏设计及其实现
- 驻云科技李俊涛：AI驱动的云上服务新趋势与挑战
- 6LoWPAN物联网边界路由器：设计与实现
- 猩便利工程师仲小玉：Terraform云资源管理最佳实践与团队协作
- 类差分度改进的互信息特征选择提升文本分类性能
- VERITAS与阿里云合作的混合云转型与数据保护方案
- 云制造中的生产线仿真模型设计与虚拟化研究
- 汪洋在PostgresChina2018分享：高可用 PostgreSQL 工具与架构设计
- 2018 PostgresChina大会：阿里云时空引擎Ganos在PostgreSQL中的创新应用与多模型存储
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
