Problem - Kevin Tafuro

Discussion
Buffer overflows get a lot of attention in the technical world, partially because they
constitute one of the largest classes of security problems in code, but also because
they have been around for a long time and are easy to get rid of, yet still are a huge
problem.
Buffer overflows are generally very easy for a C or C++ programmer to understand.
An experienced programmer has invariably written off the end of an array, or
indexed into the wrong memory because she improperly checked the value of the
index variable.
Because we assume that you are a C or C++ programmer, we won’t insult your intelligence
by explaining buffer overflows to you. If you do not already understand the
concept, you can consult many other software security books, including Building
Secure Software by John Viega and Gary McGraw (Addison Wesley). In this recipe,
we won’t even focus so much on why buffer overflows are such a big deal (other
resources can help you understand that if you’re insatiably curious). Instead, we’ll
focus on state-of-the-art strategies for mitigating these problems.
String handling
Most languages do not have buffer overflow problems at all, because they ensure
that writes to memory are always in bounds. This can sometimes be done at compile
time, but generally it is done dynamically, right before data gets written. The C and
C++ philosophy is different—you are given the ability to eke out more speed, even if
it means that you risk shooting yourself in the foot.
Unfortunately, in C and C++, it is not only possible to overflow buffers but also
easy, particularly when dealing with strings. The problem is that C strings are not
high-level data types; they are arrays of characters. The major consequence of this
nonabstraction is that the language does not manage the length of strings; you have
to do it yourself. The only time C ever cares about the length of a string is in the standard
library, and the length is not related to the allocated size at all—instead, it is
delimited by a 0-valued (NULL) byte. Needless to say, this can be extremely errorprone.
One of the simplest examples is the ANSI C standard library function, gets( ):
char *gets(char *str);
This function reads data from the standard input device into the memory pointed to
by str until there is a newline or until the end of file is reached. It then returns a
pointer to the buffer. In addition, the function NULL-terminates the buffer.
If the buffer in question is a local variable or otherwise lives on the program stack,
then the attacker can often force the program to execute arbitrary code by overwriting
important data on the stack. This is called a stack-smashing attack. Even when
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Preventing Buffer Overflows | 79