Re: New Microsoft Bug Problems Blamed On Globalization

From: Bill Unruh (unruh@physics.ubc.ca)
Date: 02/18/02 

From: unruh@physics.ubc.ca (Bill Unruh)
Date: 18 Feb 2002 17:08:05 GMT

In <1014040510.2621.0.nnrp-12.3e31ffea@news.demon.co.uk> "Ken Hagan" <K.Hagan@thermoteknix.co.uk> writes:

]Lest this go unchallenged, I would point out that it, and all the
]people quoted in it, are talking utter baloney. Buffer overruns
]are not prevented by guessing how much space you might need. (Quite
]the contrary.) Instead, they are prevented by measuring how much
]space you actually need and ensuring that you allocate that much.

No. No matter how much buffer you allocate it can always be overrun by an attacker. The
question is how you handle overruns. Do you allow anything to write beyond the end of the
buffer? If you do your code is a disaster., no matter how big a buffer you allocated.
This is absolutely attrocious software engineering.

]Multi-byte characters change nothing.

]"Jerry Leslie" <leslie@clio.rice.edu> wrote...
]>
]> http://www.newsbytes.com/news/02/174512.html
]> New Microsoft Bug Problems Blamed On Globalization

][snip]

]> Languages with extensive alphabets, such as Japanese, require that
]> programmers set aside bigger buffers in the program's memory - or risk
]> creating Unicode vulnerabilities of the sort in Microsoft's Internet
]> Information Server (IIS) Web software that led to the Code Red worm
]> last year, according to the essay, which is entitled "The Pitfalls of
]> Writing Global Software."

Relevant Pages

  • Re: Thorny Serial Comms "UART: Overrun" error Windows CE 5.0
    ... If it does not uses PDC or DMA, this could explain the overruns ... > I don't know if it is the serial driver or the UART. ... >> Do you know if it's the UART's FIFO buffer or the Serial Driver's ... and if you are not handshaking should solve this. ...
    (microsoft.public.windowsce.platbuilder)
  • Re: [Lit.] Buffer overruns
    ... > Why stop with disabling ABC if cycles are so expensive? ... > How do I know that the program truly has no buffer overruns? ... >> If it modded the source code, ...
    (sci.crypt)
  • Re: [Lit.] Buffer overruns
    ... But I'm not advocating perfect security. ... > I agree that buffer overruns are unreasonable. ... > cause - sloppy programming practices. ...
    (sci.crypt)
  • [PATCH] cpm_uart: Fix dpram allocation and non-console uarts
    ... Makes non-console UART work on both 8xx and 82xx ... static unsigned int cpm_uart_tx_empty(struct uart_port *port) ... /* Write back buffer pointer */ ... * Allocate DP-Ram and memory buffers. ...
    (Linux-Kernel)
  • Re: Access violation with heap memory
    ... I'm getting a runtime access violation using heap memory that was ... Now, when I try to access the buffer in the main function, I ... Why are you using 'char'? ... Note that there is no need to allocate storage until you are in the FillBuf, ...
    (microsoft.public.vc.mfc)
Quantcast