Problem - Kevin Tafuro

Discussion
Both C and C++ allow the definition of functions that take a variable number of
arguments. The header file stdarg.h defines three macros, * va_start( ), va_arg( ), and
va_end( ), that can be used to obtain the arguments in the variable argument list.
First, you must call the macro va_start( ), possibly followed by an arbitrary number
of calls to va_arg( ), and finally, you must call va_end( ).
A function that takes a variable number of arguments does not know the number of
arguments present or the type of each argument in the argument list; the function
must therefore have some other way of knowing how many arguments should be
present, so as to not make too many calls to va_arg( ). In fact, the ANSI C standard
does not define the behavior that occurs should va_arg( ) be called too many times.
Often, the behavior is to keep returning data from the stack until a hardware exception
occurs, which will crash your program, of course.
Calling va_arg( ) too many times can have disastrous effects. In Recipe 13.2, we discussed
format string attacks against the printf family of functions. One particularly
dangerous format specifier is %n, which causes the number of bytes written so far to
the output destination (whether it’s a string via sprintf( ), or a file via fprintf( )) to
be written into the next argument in the variable argument list. For example:
int x;
printf("hello, world%n\n", &x);
In this example code, the integer value 12 would be written into the variable x. Imagine
what would happen if no argument were present after the format string, and the
return address were the next thing on the stack: an attacker could overwrite the
return address, possibly resulting in arbitrary code execution.
There is no easy way to protect the printf family of functions against this type of
attack, except to properly sanitize input that could eventually make its way down
into a call to one of the printf family of functions. However, it is possible to protect
variable argument functions that you write against possible mistakes that would
leave the code vulnerable to such an attack.
The first solution we’ve presented is compiler- and processor-specific because it
makes use of a GCC-specific built-in function, __builtin_frame_address( ), and of
knowledge of how the stack is organized on an x86 based processor to determine
where the arguments pushed by the caller end. With a small amount of effort, this
* The ANSI C standard dictates that va_start( ), va_arg( ), and va_end( ) must be macros. However, it does
not place any requirements on their expansion. Some implementations may simply expand the macros to
built-in function calls (GCC does this). Others may be expressions performing pointer arithmetic (Microsoft
Visual C++ does this). Others still may provide some completely different kind of implementation for the
macros.
Using Variable Arguments Properly | 711
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.