-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
hope its ok that i answer to the list :)
first thing :)
as far as i know, in PLAIN C a function call is not allowed
during the definition of a variable
{ char *buf1 = malloc(SIZE); }
but in C++, it is allowed.
but actually i am not that sure, because gcc simply compiles it
without a warning. someone knows? i've lent my favorite C book
to a friend.
second thing:
two ways are used to copy a string into a buffer:
[1] { strncpy(buf2, p2, SIZE); }
and
[2] { for (i = 0; i <= SIZE && p1[i] != '\0'; i++) buf1[i] = p1[i]; }
it is obvious that [1] will always copy SIZE chars.
thats bad because in this case, if strlen(p2) >= SIZE, the final string
in buf1 will NOT be terminated with a NULL.
this could be used later on for something bad. but not in this context.
in opposite, [2] will copy MIN( 0..SIZE , STRLEN(p1)+1 ),
that is: MIN( SIZE+1 , STRLEN(p1)+1 ), which will write one char beyond
the end of the buffer, if the string p1 is longer or equal SIZE.
actually, this string will NEVER be null-terminated
(just look, when the for-loop is terminated: if it finds a \000 char)
so here we have two bad things:
1. strings that are not null-terminated (may not be too bad, if handled
properly later on when playing with the strings)
2. a buffer overflow, if strlen(p1) >= SIZE.
actually my gcc-compiled version does not catch this one with a SIGSEGV,
but i don't know why. i've checked it with ddd, it really overwrites one
char behind the end of the buffer.
now the question: can we use this buffer overflow?
actually in this case not, because the allocation of the buffer is done
with malloc. on linux at least :) malloc does not use the stack but it
uses the HEAP.
- ------------------------------------------------------------------------ >8
// vulndev-1.c
// vuln-dev mailing list security challenge #1
// by Aaron Adams <aadamsat_private>
// Spot the error in this program.
#include <stdio.h>
#include <stdlib.h>
#define SIZE 252
int
main(int argc, char *argv[])
{
int i;
char *p1, *p2;
char *buf1 = malloc(SIZE);
char *buf2 = malloc(SIZE);
if (argc != 3)
exit(1);
p1 = argv[1], p2 = argv[2];
strncpy(buf2, p2, SIZE);
for (i = 0; i <= SIZE && p1[i] != '\0'; i++)
buf1[i] = p1[i];
free(buf1);
free(buf2);
return 0;
}
- ------------------------------------------------------------------------ >8
- --
This is a .signature-virus. If you see this, copy it into your .signature!
If you don't know what a .signature is, you've most probably been infected
by another virus of name Microsoft. In this case, please remove yourself
from my fov or infect yourself with linux ;) || GPG public key available
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE+wTrcWCFHEwXrEHMRAmd5AJ9cmBJhjC687MaSWsegVlu9URELBwCeOJXH
IrTk+Y7gw6UbhGqqWiRGltk=
=OVCZ
-----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue May 13 2003 - 15:16:32 PDT