Jochen Thomas Bauer wrote: [...] > there > may be some more "scenarios", depending on the architecture/compiler/options > combination used to compile xlock, so the question is if there is any > combination of architecture/compiler/options that will produce code > that contains a security hole. [...] I have found two compilers generating security holes this way: - Microwerks CodeWarrior for Macintosh - ORCA/C for GS/OS (Apple IIgs) - various microcontroller compilers CodeWarrior generates, with optimizations enabled, a program that simply crashes, while overwriting a byte of program stack. ORCA/C isn't capable of handling negative indexes. There might be some more compilers out there not able handling negative indexes (I pointed this out to the list, but my mail didn't get trough): ANSI-C doesn't tell how a compiler has to handle negative indexes. They may be handled as you expect, -1 is one less than the pointer or they may be handled like pointer + max. unsigned int which turns out to be pointer + 65535. In reality this depends on the capabilities of your hardware. If indexing is possible with one byte it is pointer + 255. If four byte it is pointer + (2^32)-1. The byte really accessed depends on how wide your address bus is. If index-with and address-bus-width match nothing will be wrong. If not (index size is smaller) pray! On some CPU this might be more complex as described here, depending on CPU mode. Wraparound may occur at segment boundaries or similar odd things...! ORCA/C will therefor overwrite a byte offset 65535 bytes from pointer. In most cases this doesn't have any immediate effect, but some time later (you might have the malicious program finished already) the system crashes. Most Microcontroller C-Compilers allocate string space not directly on stack. They allocate memory leaving only a pointer to it on stack, cause of low stack space. Some of these Compilers may fiddle with negative indexes correctly (as one would expect), some don't, some generate runtime errors instead. All possible to, at least, DoS attacks. -- Thomas Schweikle <tschweikat_private> PS.: ORCA/C was once built for the Apple IIgs operating system GS/OS. Does anyone fiddle with it anymore? Maybe using GNO/ME environment with it?
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:22:50 PDT