Bug Hunter Diary

is less than 12. If it is, the string “argument length ok” will be printedon the screen. Since length gets assigned the value 0xffffffff and thisvalue is much bigger than 12, it may seem obvious that the string willnot be printed. However, let’s see what happens if we compile andrun the program under Windows Vista SP2:C:\Users\tk\BHD>cl /nologo implicit.cimplicit.cC:\Users\tk\BHD>implicit.exelength: -1 4294967295 (0xffffffff)argument length okAs you can see from the output, line 19 was reached and executed.How did this happen?On a 32-bit machine, an unsigned int has a range of 0 to4294967295 and a signed int has a range of –2147483648 to 2147483647.The unsigned int value 0xffffffff (4294967295) is represented inbinary as 1111 1111 1111 1111 1111 1111 1111 1111 (see Figure A-3). Ifyou interpret the same bit pattern as a signed int, there is a changein sign that results in a signed int value of –1. The sign of a numberis indicated by the sign bit, which is usually represented by the MostSignificant Bit (MSB). If the MSB is 0, the number is positive, and if itis set to 1, the number is negative.MSBbinarysigned intFF FF FF FF1111 1111 1111 1111 1111 1111 1111 1111-17F FF FF FF0111 1111 1111 1111 1111 1111 1111 1111+2147483647MSBFigure A-3: The role of the Most Significant Bit (MSB)To summarize: If an unsigned int is converted to a signed intvalue, the bit pattern isn’t changed, but the value is interpreted inthe context of the new type. If the unsigned int value is in the range0x80000000 to 0xffffffff, the resulting signed int will become negative(see Figure A-4).This was only a brief introduction to implicit and explicit typeconversions in C/C++. For a complete description of type conversionsin C/C++ and associated security problems, see Mark Dowd, JohnMcDonald, and Justin Schuh’s The Art of Software Security Assessment:Identifying and Avoiding Software Vulnerabilities (Addison-Wesley, 2007).156 Appendix A