-4

It seems to me that buffer overflows are considered to be the most common and dangerous security flaws in programs today. But I don't understand how. Why don't developers just use find and replace function to replace all unsafe implementations of I/O with the safe ones?

Why don't big companies like Adobe and Microsoft just fix it once and for all and forever?

12
  • 3
    While a simple text search could find some buffer overflows, it could not find all. It's a lot more complicated than that.
    – Anders
    Apr 23, 2018 at 12:05
  • 1
    How do you "use find and replace" when you can have thousands of functions from unknown sources? What do you look for?
    – schroeder
    Apr 23, 2018 at 12:13
  • I would look for any case of strcpy/gets/etc function being used and replacing them with a safe alternative or explicit bounds checking. Thousands of functions or not, something like this would take a few lines of code in Python.
    – Gillian
    Apr 23, 2018 at 16:50
  • 1
    The issue isn't like trying to solve the problem, it is trying to solve the halting problem. And the sort of check you mentioned is what UBSAN does. However it's not the only possible issue (take for example pointer arithmetic).
    – forest
    Apr 24, 2018 at 9:53
  • 2
    "Halt" can be replaced with "reach any arbitrary state".
    – forest
    Apr 24, 2018 at 23:09

1 Answer 1

3

With a small loan of 100 billion dollar i think they can fix it!

The Problem is that there are to many usage of different concepts of memory allocations which all are specific for that case. To that it is that most of the Softwares out in the wild are many years old in some parts, so that a "just fix it" could be a disaster due to incompatibility and bugs. Not to speak of the amount of work time they must spend in it.

TL;DR: "just fix all bugs" is possible, if you have the amount of money, workers and time. But nobody has it

10
  • 1
    How money and time are a guarantee to fix all bugs? Humans are imperfect, it doesn't matter how rich they are etc.
    – user155462
    Apr 23, 2018 at 12:55
  • 1
    1) Pay people to not use your software 2) All bugs are fixed! Apr 23, 2018 at 13:11
  • @user155462 with the pseudo-infinite amount of money you could buy many developers who are nearly perfect. More nearly perfect developers + code reviews = nearly perfectly bugfree application
    – Serverfrog
    Apr 23, 2018 at 13:29
  • @user155462 Generally, formally verified (mathematically proven correct) software can cost around $10,000 per line of code.
    – forest
    Apr 23, 2018 at 13:42
  • @Serverfrog Some people have "fixed all bugs". Look into seL4, miTLS, and HTTP.sys.
    – forest
    Apr 23, 2018 at 13:43

Not the answer you're looking for? Browse other questions tagged .