Problem - Kevin Tafuro

To combat malicious uses of “%n”, Immunix has produced a set of patches for
glibc 2.2 (the standard C runtime library for Linux) known as FormatGuard. The
patches take advantage of a GCC compiler extension that allows the preprocessor
to distinguish between macros having the same name, but different numbers
of arguments. FormatGuard essentially consists of a large set of macros for the
syslog( ), printf( ), fprintf( ), sprintf( ), and snprintf( ) functions; the macros
call safe versions of the respective functions. The safe functions count the
number of substitutions in the format string, and ensure that the proper number
of arguments has been supplied.
Do not use a string from an external source directly as the format specification.
Strings obtained from an external source may contain unexpected percent symbols
in them, causing the formatting function to attempt to substitute arguments
that do not exist. If you need simply to output the string str (to stdout
using printf( ), for example), do the following:
printf("%s", str);
Following this rule to the letter is not always desirable. In particular, your program
may need to obtain format strings from a data file as a consequence of
internationalization requirements. The format strings will vary to some extent
depending on the language in use, but they should always have identical substitutions.
When using vsprintf( ) or sprintf( ) to output to a string, be very careful of using the
“%s” substitution without specifying a precision.
The vsprintf( ) and sprintf( ) functions both assume an infinite amount of
space is available in the buffer into which they write their output. It is especially
common to use these functions with a statically allocated output buffer. If a
string substitution is made without specifying the precision, and that string
comes from an external source, there is a good chance that an attacker may
attempt to overflow the static buffer by forcing a string that is too long to be
written into the output buffer. (See Recipe 3.3 for a discussion of buffer overflows.)
One solution is to check the length of the string to be substituted into the output
before using it with vsprintf( ) or sprintf( ). Unfortunately, this solution is
error-prone, especially later in your program’s life when another programmer
has to make a change to the size of the buffer or the format string, necessitating a
change to the check.
A better solution is to use a precision modifier in the format string. For example,
if no more than 12 characters from a string should ever be substituted into
the output, use “%.12s” instead of simply “%s”. The advantage to this solution
is that it is part of the formatting function call; thus, it is less likely to be overlooked
in the event of a later change to the format string.
Preventing Attacks on Formatting Functions | 77
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.