It seems to me that buffer overflows are considered to be the most common and dangerous security flaws in programs today. But I don't understand how. Why don't developers just use find and replace function to replace all unsafe implementations of I/O with the safe ones?

Why don't big companies like Adobe and Microsoft just fix it once and for all and forever?

  • 3
    While a simple text search could find some buffer overflows, it could not find all. It's a lot more complicated than that. – Anders Apr 23 '18 at 12:05
  • 1
    How do you "use find and replace" when you can have thousands of functions from unknown sources? What do you look for? – schroeder Apr 23 '18 at 12:13
  • I would look for any case of strcpy/gets/etc function being used and replacing them with a safe alternative or explicit bounds checking. Thousands of functions or not, something like this would take a few lines of code in Python. – Gillian Apr 23 '18 at 16:50
  • 1
    The issue isn't like trying to solve the problem, it is trying to solve the halting problem. And the sort of check you mentioned is what UBSAN does. However it's not the only possible issue (take for example pointer arithmetic). – forest Apr 24 '18 at 9:53
  • 1
    "Halt" can be replaced with "reach any arbitrary state". – forest Apr 24 '18 at 23:09

With a small loan of 100 billion dollar i think they can fix it!

The Problem is that there are to many usage of different concepts of memory allocations which all are specific for that case. To that it is that most of the Softwares out in the wild are many years old in some parts, so that a "just fix it" could be a disaster due to incompatibility and bugs. Not to speak of the amount of work time they must spend in it.

TL;DR: "just fix all bugs" is possible, if you have the amount of money, workers and time. But nobody has it

| improve this answer | |
  • 1
    How money and time are a guarantee to fix all bugs? Humans are imperfect, it doesn't matter how rich they are etc. – user155462 Apr 23 '18 at 12:55
  • 1
    1) Pay people to not use your software 2) All bugs are fixed! – Monica Apologists Get Out Apr 23 '18 at 13:11
  • @user155462 with the pseudo-infinite amount of money you could buy many developers who are nearly perfect. More nearly perfect developers + code reviews = nearly perfectly bugfree application – Serverfrog Apr 23 '18 at 13:29
  • @user155462 Generally, formally verified (mathematically proven correct) software can cost around $10,000 per line of code. – forest Apr 23 '18 at 13:42
  • @Serverfrog Some people have "fixed all bugs". Look into seL4, miTLS, and HTTP.sys. – forest Apr 23 '18 at 13:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.