Problem - Kevin Tafuro

In this example, if you omitted the calls to safestr_reference( ) and safestr_
release( ), and if extra was a temporary string, the call to safestr_length( ) would
cause the string to be destroyed. As a result, the safestr_append( ) call would then be
operating on an invalid safestr_t if the combined length of base and extra were less
than 17.
Finally, the SafeStr library also tracks the trustworthiness of strings. A string can be
either trusted or untrusted. Operations that combine strings result in untrusted
strings if any one of the strings involved in the combination is untrusted; otherwise,
the result is trusted. There are few places in SafeStr’s API where the trustworthiness
of a string is tested, but the function safestr_istrusted( ) allows you to test strings
yourself.
The strings that result from using SAFESTR_CREATE( ) or SAFESTR_TEMP( ) are untrusted.
You can use SAFESTR_TEMP_TRUSTED( ) to create temporary strings that are trusted.
The trustworthiness of an existing string can be altered using safestr_trust( ) to
make it trusted or safestr_untrust( ) to make it untrusted.
The main reason to track the trustworthiness of a string is to monitor the flow of
external inputs. Safe strings created from external data should initially be untrusted.
If you later verify the contents of a string, ensuring that it contains nothing dangerous,
you can then mark the string as trusted. Whenever you need to use a string to
perform some potentially dangerous operation (for example, using a string in a command-line
argument to an external program), check the trustworthiness of the string
before you use it, and fail appropriately if the string is untrusted.
See Also
• SafeStr: http://www.zork.org/safestr/
• Recipes 3.2, 3.3
3.5 Preventing Integer Coercion and
Wrap-Around Problems
Problem
When using integer values, it is possible to make values go out of range in ways that
are not obvious. In some cases, improperly validated integer values can lead to security
problems, particularly when data gets truncated or when it is converted from a
signed value to an unsigned value or vice versa. Unfortunately, such conversions
often happen behind your back.
88 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.