2

Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose. One reason that I could think of was that structure instances would get cleaned up thanks to instruction stack but pointer value would not. Is there any other reason? Wouldn't an attacker be unable to access my memory in any of the two cases?

EDIT: Adding the code snippet:

static void make_digest( const EVP_MD *md, char *header, char *message,unsigned char *digest)
{
   EVP_MD_CTX *mdctx;
   unsigned int digest_len = 0;

   EVP_MD_CTX_init(mdctx);
   EVP_DigestInit_ex(mdctx, md, NULL);
   EVP_DigestUpdate(mdctx, header, strlen( header ));
   EVP_DigestUpdate(mdctx, message, 32);
   EVP_DigestFinal_ex(mdctx, digest, &digest_len);
   EVP_MD_CTX_cleanup(mdctx);
   return;
}
7
  • Are you able to share the code snippet?
    – paj28
    May 2 '16 at 10:33
  • The programming language might be relevant for this.
    – Philipp
    May 2 '16 at 11:40
  • @paj28 hope this helps
    – Limit
    May 2 '16 at 12:24
  • It sure does. So what exactly did your senior dev recommend? Instead of "const EVP_MD *md" you should use "const EVP_MD md" ? I don't know exactly what he had in mind, but I wouldn't make the same recommendation. I think it's fine as it is.
    – paj28
    May 2 '16 at 13:21
  • 1
    Your added code is not just insecure but defective because you use an uninitialized local pointer, which is formally Undefined Behavior and in practice usually garbage that corrupts some unknown data somewhere. For OpenSSL specifically (nearly?) all objects provide either _new/free or _create/destroy routines; EVP_MD_CTX does the latter. But sensitive data in MD_CTX is already 'cleansed' usually by DigestFinal and if that doesn't by cleanup or destroy whichever applies. May 4 '16 at 11:29
5

I don't know the specifics of the routine you were asked to amend, but I can tell you the following.

When you allocate memory on the heap, even if you correctly de-allocate it, there is no guarantee that the contents of that memory is erased after you're done with it.

On the stack it's the same deal - however because of the way the stack works - that memory is more likely to be overwritten in short-order (heck, the next function might overwrite it). With memory allocated on the heap, the time for it to be over-written is indeterminable from your perspective as a programmer.

So to answer your question - an attacker might be able to read the memory in both instances - but during the course of running your program, the stack is potentially going to be overwritten immediately, whereas the data in your heap allocation would be much easier to find long after your program deallocated it.

1
  • Stack based security breaches are much more common since the attacker can use the stack pointer to reference (mostlyj known good memory.
    – simpleuser
    May 2 '16 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.