1

These days memcpy is protected by an interface named _memcpy_chk, which checks the size of the destination buffer at runtime. After reading the source code for _memcpy_chk at http://www.opensource.apple.com/source/Libc/Libc-825.40.1/secure/memcpy_chk.c it seems like a solid mitigation.

Are buffer overflows with memcpy simply impossible on modern computers simply impossible at this point? Should we even bother looking for them on properly compiled programs?

  • "impossible on modern computers" the hardware is still vulnerable so any "modern computer" is vulnerable. – d1str0 Mar 9 '16 at 1:10
  • Where does the value of dstlen come from? If you have a function that accepts a pointer to a destination as an argument, that function can't know how large the destination is supposed to be. I think this memcpy protection only could work if the destination was allocated in the function that called memcpy. – Macil Mar 9 '16 at 2:51
1

Looks like it's still possible to overflow if you try (or just make a mistake) with this example implementation of memcpy:

$ cat mc.c
#include <string.h>
#include <stdio.h>

#undef memcpy
#define bos0(dest) __builtin_object_size (dest, 0)
#define memcpy(dest, src, n) \
    __builtin___memcpy_chk (dest, src, n, bos0 (dest))

int main() {
    char baz[64];
    char bar[16];    
    char foo[16];
    char* f = foo;
    char* b = baz;
    int len = 26;

    strncpy(baz, "abcdefghijklmnopqrstuvwxyz", 26);
    memset(bar, 0, sizeof(bar));
    memcpy(f, b, len); // [a-z] is bigger than foo, will overflow into bar
    printf("Evidence of buffer overflow: %s\n", bar);
    printf("now press enter to see runtime detection working properly: \n");
    (void)getchar(); // pause for user input
    memcpy(foo, bar, len);  // buffer overflow detected at runtime
    return 0;
}
$ g++ -Wall mc.c
$ ./a.out
Evidence of buffer overflow: qrstuvwxyz
now press enter to see runtime detection working properly: 

*** buffer overflow detected ***: ./a.out terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x731af)[0x7fe0327391af]
    <snip>
Aborted
$ 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.