Problem - Kevin Tafuro

There are a few ways to alleviate this particular problem:
• You can make sure never to use signed data types. Unfortunately, that is not
very practical—particularly when you are using API functions that take both
signed and unsigned values. If you try to ensure that all your data is always
unsigned, you might end up with an unsigned-to-signed conversion problem
when you call a library function that takes a regular int instead of an unsigned
int or a size_t.
• You can check to make sure x is not negative while it is still signed. There is
nothing wrong with this solution. Basically, you are always assuming the worst
(that the data may be cast), and it might not be.
• You can cast x to a size_t before you do your testing. This is a good strategy for
those who prefer testing data as close as possible to the state in which it is going
to be used to prevent an unanticipated change in the meantime. Of course, the
cast to a signed value might be unanticipated for the many programmers out
there who do not know that size_t is not a signed data type. For those people,
the second solution makes more sense.
No matter what solution you prefer, you will need to be diligent about conversions
that might apply to your data when you perform your bounds checking.
Unsigned-to-signed coercion
Problems may also occur when an unsigned value gets converted to a signed value.
For example, consider the following code:
int main(int argc, char *argv[ ]) {
char foo[ ] = "abcdefghij";
char *p = foo + 4;
unsigned int x = 0xffffffff;
if (p + x > p + strlen(p)) {
printf("Buffer overflow!\n");
return -1;
}
printf("%s\n", p + x);
return 0;
}
The poor programmer who wrote this code is properly preventing from reading past
the high end of p, but he probably did not realize that the pointers are signed.
Because x is –1 once it is cast to a signed value, the result of p + x will be the byte of
memory immediately preceding the address to which p points.
While this code is a contrived example, this is still a very real problem. For example,
say you have an array of fixed-size records. The program might wish to write arbitrary
data into a record where the user supplies the record number, and the program
might calculate the memory address of the item of interest dynamically by multiplying
the record number by the size of a record, and then adding that to the address at
90 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.