1

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.

Here is the question. Sorry the original condition of my document is badly scanned before it was handed to me.

Pic 1

Pic 2

I have several discussions with my friends, and they suggested this solution for (a).

Fill the first 50 characters of B with non-null characters and the 51st element with a null terminator. The length of the string represented will be 50, as shown from strlen(B), this causes the branch with strncpy(A,B,C) to occur, which will copy the first 50 characters of B into A.

Later on when the loop is called, number of loops equal to the length of B, there will be a Buffer Overread as it reads outside the bounds of the array A.

As C is an unsigned char with bounds 0 to 255 while strlen returns unsigned int with bounds 0 to 2^32 – 1, the extent of Buffer Overread will differ.

(b) will require me to assume this is the case in (a), and will require me to answer it like this:

When printf() is called, it will result in an infinite loop as with the same configuration, the '\0’ cannot be found in the array.

I’m not sure whether my logic is correct, but the worst part is I’m unable to replicate this.

Just running the code segment on MacOS Mojave, as shown below, already gives me an “Abort Trap, and many people call this Buffer Overflow.

I’m not sure about my logic and the reason why I cant replicate the problem, can someone help me out?

int main() {
    char buffer[2];
    char str [3] = "sa";

    if (strlen(str) <=2) {
        strcpy(buffer, str);
    }


    printf("%lu\n",strlen(buffer));



    return 0;
}
  • regarding: c = strlen(b); This is undefined behavior because the array b[[] has not been assigned any specific value, so it is unknown when/where a char string trailing byte (a NUL character) will be encountered – user3629249 Nov 22 '19 at 21:12
  • regarding: for( int i=0; i< strlen(b); i++) This will cause the compiler to output a warning message because the function: strlen() returns a size_t not a int. Strongly suggest: for( size_t i=0; i< strlen(b); i++) – user3629249 Nov 22 '19 at 21:16
  • regarding: {printf( "%d\n", a[i])} 1) use appropriate horizontal spacing for readability. 2) the array a[] is composed of characters, not integers. Suggest: { printf( "%c\n", a[i] ) } Notice the use of the %c output format specifier to output a char. 3) please follow the axiom: only one statement per line and (at most) one variable declaration per statement. In general, consider '{' and '}' to be complete statements, – user3629249 Nov 22 '19 at 21:21
  • regarding: if (strlen(str) <=2) { strcpy(buffer, str); the array: str[] will overflow the array; buffer[] the result is undefined behavior. – user3629249 Nov 22 '19 at 21:23
  • regarding: printf("%lu\n",strlen(buffer)); This will 'work', however, the correct output format specifier for a size_t is %zu – user3629249 Nov 22 '19 at 21:30
0

Your assumption is correct. The issue is with the logic in the for() loop. if you run the following code you will find it runs beyond the value of C in the exercise provided. I have added notes for you in the requirements of the exercise.

main() {

unsigned char b[1500];
unsigned char a[50];
unsigned char C;

int i;

bzero( (char *)b , 1500);

/* lets fill b[X] with null values */
for (i=0; i <= 1024; i++ ) { /* no less than 1024 */
        b[i]='0x0';
}

/* put the letter A in b[X] */
for (i=0; i < 50; i++ ) {
        b[i]="1"; /* only numeric chars */
}

C = strlen(b);

if ( C <= 50 ) {
        strncpy(a, b, C );
        printf("b = %lu\n a = %d\n ", strlen(b), strlen(a));

        for ( i=0; i < strlen(b); i++ ) {
                printf("%d\n", a[i]);
        }
        printf("the value of i in the loop:  %d\n", i);

}

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.