Problem - Kevin Tafuro

Avoid using vsprintf( ) and sprintf( ). Use vsnprintf( ) and snprintf( ) or
vasprintf( ) and asprintf( ) instead. Alternatively, use a secure string library such as
SafeStr (see Recipe 3.4).
The functions vsprintf( ) and sprintf( ) assume that the buffer into which they
write their output is large enough to hold it all. This is never a safe assumption
to make and frequently leads to buffer overflow vulnerabilities. (See Recipe 3.3.)
The functions vasprintf( ) and asprintf( ) dynamically allocate a buffer to hold
the formatted output that is exactly the required size. There are two problems
with these functions, however. The first is that they’re not portable. Most modern
BSD derivatives (Darwin, FreeBSD, NetBSD, and OpenBSD) have them, as
does Linux. Unfortunately, older Unix systems and Windows do not. The other
problem is that they’re slower because they need to make two passes over the
format string, one to calculate the required buffer size, and the other to actually
produce output in the allocated buffer.
The functions vsnprintf( ) and snprintf( ) are just as fast as vsprintf( ) and
sprintf( ), but like vasprintf( ) and asprintf( ), they are not yet portable. They
are defined in the C99 standard for C, and they typically enjoy the same availability
as vasprintf( ) and asprintf( ). They both require an additional argument
that specifies the length of the output buffer, and they will never write
more data into the buffer than will fit, including the NULL terminating character.
See Also
• FormatGuard from Immunix: http://www.immunix.org/formatguard.html
• Recipes 3.3, 13.4
3.3 Preventing Buffer Overflows
Problem
C and C++ do not perform array bounds checking, which turns out to be a securitycritical
issue, particularly in handling strings. The risks increase even more dramatically
when user-controlled data is on the program stack (i.e., is a local variable).
Solution
There are many solutions to this problem, but none are satisfying in every situation.
You may want to rely on operational protections such as StackGuard from Immunix,
use a library for safe string handling, or even use a different programming language.
78 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.