C和C++安全编码读书笔记1
(1)type safety
Another characteristic of C that is worth mentioning is the lack of type safety. Type safety consists of two attributes: preservation and progress [Pfenning 04]. Preservation dictates that if a variable x has type t and x evaluates to a value v, then v also has type t. Progress tells us that evaluation of an expression does not get stuck in any unexpected way: either we have a value (and are done), or there is a way to proceed. In general, type safety implies that any operation on a particular type results in another value of that type. C was derived from two typeless languages and still shows many characteristics of a typeless or weakly typed language. For example, it is possible to use an explicit cast in C to convert from a pointer to one type to a pointer to a different type. If the resulting pointer is dereferenced, the results are undefined. Operations can legally act on signed and unsigned integers of differing lengths using implicit conversions and producing unrepresentable results. This lack of type safety leads to a wide range of security flaws and vulnerabilities.
由于C语言存在(隐式/显式)类型转换,所以容易产生许多安全问题。
(2)Unbounded String Copies
防止cin越界的方法:
1. #include <iostream> 2. int main(void) {
3. char buf[12]; 4. cin.width(12);
5. cin >> buf;
6. cout << "echo: " << buf << endl;
7. }
The extraction operation can be limited to a specified number of characters (thereby avoiding the possibility of out-of-bounds write) if the field width inherited member (ios_base::width) is set to a value greater than 0. In this case, the extraction ends one character before the count of characters extracted reaches the value of field width leaving space for the ending null character. After a call to this extraction operation the value of the field width is reset to 0.
需要注意这个width是一次性的,每次调用 >> 后都会归0。
代码进行PCLint检查时常常提示strcpy不安全,有机会要整改一下。
(3)Off-by-One Errors
经典程序
1. int main(int argc, char* argv[]) {
2. char source[10];
3. strcpy(source, "0123456789");
4. char *dest = (char *)malloc(strlen(source));
5. for (int i=1; i <= 11; i++) {
6. dest[i] = source[i];
7. }
8. dest[i] = '\0';//据书上说VC++ 6.0能编译通过
9. printf("dest = %s", dest);
10. }
The source character array (declared on line 2) is 10 bytes long, but strcpy() (line 3) copies 11 bytes, including a one-byte terminating null character.
The malloc() function (line 4) allocates memory on the heap of the length of the source string. However, the value returned by strlen() does not account for the null byte.
The index value i in the for loop (line 5) starts at 1, but the first position in a C array is indexed by 0.
The ending condition for the loop (line 5) is i <= 11. This means the loop will iterate one more time than the programmer likely intended.
The assignment on line 8 also causes an out-of-bounds write.
(4)Null-Termination Errors
依赖于编译器如何分配空间,了解各种编译器貌似一个大坑,还是别跳了,老老实实注意不要忘了'\0’
C和C++安全编码读书笔记1的更多相关文章
- 汉字与区位码互转(天天使用Delphi的String存储的是内码,Windows记事本存储的文件也是内码),几个常见汉字的各种编码,utf8与unicode的编码在线查询,附有读书笔记 good
汉=BABA(内码)=-A0A0=2626(区位码)字=D7D6(内码)=-A0A0=5554(区位码) 各种编码查询表:http://bm.kdd.cc/ 汉(记住它,以后碰到内存里的数值,就会有敏 ...
- 《JavaScript高级程序设计》读书笔记--前言
起因 web编程过程使用javascript时感觉很吃力,效率很低.根本原因在于对javascript整个知识体系不熟,看来需要找些书脑补一下,同时欢迎众网友监督. 大神推荐书籍 看了博客大神们推荐的 ...
- <读书笔记> 代码整洁之道
概述 1.本文档的内容主要来源于书籍<代码整洁之道>作者Robert C.Martin,属于读书笔记. 2.软件质量,不仅依赖于架构和项目管理,而且与代码质量紧密相关,本书提出一 ...
- <读书笔记>软件调试之道 :问题的核心-修复后的反思
声明:本文档的内容主要来源于书籍<软件调试修炼之道>作者Paul Butcher,属于读书笔记.欢迎转载! ---------------------------------------- ...
- <读书笔记>软件调试之道 :问题的核心-诊断
声明:本文档的内容主要来源于书籍<软件调试修炼之道>作者Paul Butcher,属于读书笔记. 不要急于动手! 尽管可以利用各种工具和技术以及软件自身查找缺陷,但是你最重要的财富是你的智 ...
- <读书笔记>软件调试之道 :问题的核心-重现问题
声明:本文档的内容主要来源于书籍<软件调试修炼之道>作者Paul Butcher,属于读书笔记. 重现第一,提问第二 问题重现是实证过程的最强大武器,如果不能重现问题,你也无法证明修复了它 ...
- WPF,Silverlight与XAML读书笔记第四十八 - Silverlight网络与通讯
说明:本系列基本上是<WPF揭秘>的读书笔记.在结构安排与文章内容上参照<WPF揭秘>的编排,对内容进行了总结并加入一些个人理解. 这一部分我们重点讨论下Silverlight ...
- WPF,Silverlight与XAML读书笔记第四十五 - 外观效果之模板
说明:本系列基本上是<WPF揭秘>的读书笔记.在结构安排与文章内容上参照<WPF揭秘>的编排,对内容进行了总结并加入一些个人理解. 模板允许用任何东西完全替换一个元素的可视树, ...
- 《你必须知道的.NET》读书笔记三:体验OO之美
此篇已收录至<你必须知道的.Net>读书笔记目录贴,点击访问该目录可以获取更多内容. 一.依赖也是哲学 (1)本质诠释:“不要调用我们,我们会调用你” (2)依赖和耦合: ①无依赖,无耦合 ...
随机推荐
- linux下安装python3.3.4
下载安装包 # wget http://www.python.org/ftp/python/3.3.4/Python-3.3.4.tgz 解压 # tar -xzvf Python-3.3.4.tgz ...
- 史上最简单的Hibernate入门简单介绍
事实上Hibernate本身是个独立的框架,它不须要不论什么web server或application server的支持.然而,大多数的Hibernate入门介绍都加入了非常多非Hibernate ...
- Head First SQL笔记
看的时候总结了一下,如下: Chapter 1: 创建数据库 CREATE DATABASE database_name; 使用数据库 USE database_name; 创建表 CRATE TAB ...
- Object-c中@private、@protected、@public解析
Objective-C中,类的实例化变量的范围有@private.@protected.@public.他们代表的意思和C++中相同,只是前面添加了一个@符号.下面介绍一下他们代表的范围: 指令 意思 ...
- Foundation NSMutableArray遍历,选取出符合条件的所有对象
一.查找数组中一个元素,找到后立即返回 当遍历数组只需要返回其中一个符合条件的元素时,使用 indexOfObjectPassingTest:^BOOL(id obj, NSUInteger idx, ...
- ExtJs004define定义类
Ext.onReady(function () { //在Ext中如何去定义一个类: Ext.define(className , properties , callback) Ext.define( ...
- BZOJ 1816: [Cqoi2010]扑克牌( 二分答案 )
二分答案.. 一开始二分的初始右边界太小了然后WA,最后一气之下把它改成了INF... -------------------------------------------------------- ...
- codeforces 375D . Tree and Queries 启发式合并 || dfs序+莫队
题目链接 一个n个节点的树, 每一个节点有一个颜色, 1是根节点. m个询问, 每个询问给出u, k. 输出u的子树中出现次数大于等于k的颜色的数量. 启发式合并, 先将输入读进来, 然后dfs完一个 ...
- (Problem 72)Counting fractions
Consider the fraction, n/d, where n and d are positive integers. If nd and HCF(n,d)=1, it is called ...
- 韦根(Wiegand)数据传输格式
韦根数据传输使用TTL电平,有两条数据线,分别称为DATA0和DATA1.无数据传输时,两条线都是高电平,当传输“1”时,DATA0为高,DATA1为低:当传输“0”时,DATA0为低,DATA1为高 ...