Buffer Overflow Exploits doc

Bufter Overflow Exploits CS-480b Dick SteTlik... Side Effects ° The side effects of a buffer overflow may Cause.. ° the program may work strangely ° the program may fail ° the program

Bufter Overflow Exploits

CS-480b Dick SteTlik

° Anyfime we pu

structure than it

Side Effects

° The side effects of a buffer overflow may

Cause

° the program may work strangely

° the program may fail

° the program may continue without any noticeable problems

°® What data e

that gets ove

/errun a statIc butte

hurts Fhe) na tle to

control |

mc .

strcpy()

if you know the size of the destination buffer:

if (strlen(src) >= dst_size {/* throw an error */ } else { strcpy(dst, src); }

ae

strncpy(dst, src, dst_size-1);

dst[dst_size -1] = ‘\0’; /* just to be safe */

oe

/* allocate the destination buffer when you need it */ dst = (char *)malloc(strlen(src) +1);

srtcpy(dst, src)

strcat( )

/* same as srtcpy( ) but cancatenates source string to end of a buffer */ /* safer alternative is to use strncat( ) ; still need to insure you don’t */

/* overrun the destination buffer * /

strncat(dst,.src, dst_size - strlen(dst) -1);

I

re is no really portable way aro , sometimes a snprintf() *

provided that lets you 1001) 1arACf€rs {O CODy: ˆ

in(int argc , char **arg

Isage[1024]:-

on main(int cliolor or

-_ Char iO =

erence printf("%s\

gets( )

strcpy( )

strcat( )

sprintf( )

scanÍ( )

sscanf( )

fscanf( )

viscanf( )

vsscanf( )

streadd( )

strecpy( )

functions to be wary otf:

strtrns( ) realpath( )

syslog( ) getopt( )

getopt long(.) getpass( )

getchar( ) fgetc( )

getc( )

read( )

beopy()

fgets( ) memcpy( ) snprintf( ) strccpy( ) strcadd( ) strncpy( ) vsnprinff( )

heap overflows

stack overflows