C Security Code Review

Question

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are primarily related to how developers manage memory.

I'm aware of Microsofts list of banned functions not to use when writing in C -- and yes, these can be quite helpful when doing code review. I was wondering, when reviewing C code, if there are any additional methodologies that are useful to follow or resources to use?

Answer 1

For C coding interviews, review the following:

1. Integer Overflows/Underflow: https://www.exploit-db.com/docs/english/28477-linux-integer-overflow-and-underflow.pdf

2. Buffer Overflows (Stack/Heap): https://owasp.org/www-community/attacks/Buffer_overflow_attack

3. Format String Vulnerabilities: https://owasp.org/www-community/attacks/Format_string_attack

In addition to the vulnerabilities, you can expect the interviewer to ask you about basics of exploitation. You can read up on:

1. NOP Sled
2. Return to libc
3. ROP

Finally, you should review mitigations/defenses to protect against these vulnerabilities:

1. ASLR/DEP
2. Stack Canaries
3. Control Flow Integrity

Answer 2

Without an understanding of the underlying language, one problem you may have is understanding context.

While it may be best practice to eschew these banned functions completely, I see a lot of projects where some of these functions are used, but in safe contexts. If you raise a red flag simply every time you see one of these functions in use, you may have a bad time.

Here are some examples using the infamous strcpy and its slightly safer version strncpy:

void foo_1(char* bar) {
    char buf[100];
    strcpy(buf, bar);
    puts(buf);
}

char* foo_2(char* bar) {
    char* buf = NULL; 
    buf = malloc(strlen(bar)+1);
    strcpy(buf, bar);
    return buf; // freed later
}

void foo_3(char* bar) {
    char buf[100];
    strncpy(buf, bar, sizeof(buf));
    puts(buf);
}

void foo_4() {
    char buf[100];
    strcpy(buf, "This is just an example.");
    puts(buf);
}

If I did this correctly, these examples should be:

1. Unsafe (if bar is longer than 100 bytes, an overflow will occur)
2. Safe (buffer is created large enough)
3. Unsafe (produces un-terminated string when there are no null bytes in first n bytes of bar)
4. Safe (string is constant and smaller than buffer size)

From the strcpy manpage:

If the programmer knows (i.e., includes code to test!) that the size of dest is greater than the length of src, then strcpy() can be used.

If these examples are challenging, you may want to brush up on your C programming, as these are by no means complex examples.

Additionally, while the "strn" family functions also may appear on the banned list, many projects use these safely as well by forcing a null byte at the end, often done with a wrapper function.

Answer 3

google:'buffer overrun exploits' and 'python buffer overrun proof of concept'

C++ would be almost same for the problems.

Learn to code arrays in C/C++.

[1][2][3]{4}
memalloc - C++ new
memcpy - = 
free - C++ delete