Re: Stack growth direction to thwart buffer overflow attacks

From: Frank Cusack (fcusack_at_fcusack.com)
Date: 08/19/03

  • Next message: Frank Cusack: "Re: Stack growth direction to thwart buffer overflow attacks" 
    Date: Mon, 18 Aug 2003 21:00:53 -0700

    On Sat, 16 Aug 2003 13:05:20 -0400 Tony Nelson <tonynlsn@shore.net> wrote:
    > Surely not. I prefer to use:
    >
    > target[0] = 0;
    > strncat(target,source,sizeof(target));
    >
    > strncat puts a NUL at the end of the string.

    No, it doesn't. This is a prime example of what I think is a worse
    problem than the wrong language (C), it's not understanding how to
    use the API.

    strn* are NOT guaranteed to NUL terminate. They may do so on your
    specific platform, which is where you lose because your code will be
    used in unexpected ways on other platforms or other libc
    implementations.

    Why strn* were designed so poorly is another question.

    /fc

  • Next message: Frank Cusack: "Re: Stack growth direction to thwart buffer overflow attacks"

    Relevant Pages

    • Re: Stack growth direction to thwart buffer overflow attacks
      ... > strncat puts a NUL at the end of the string. ... specific platform, which is where you lose because your code will be ... Why strn* were designed so poorly is another question. ...
      (comp.security.misc)
    • Re: casts
      ... string cannot contain a Nul" is a true statement. ... Yes, it is, by definition, what a string is, in C. ... When C programmers are communicating together, ... quite elementary mistakes (such as failing to set the first character ...
      (comp.lang.c)
    • Re: InStr and striping NULs
      ... Using InStr to finfd leftmost Nul and then truncate string. ... using the cNul form causes k to always return 1. ...
      (microsoft.public.vb.general.discussion)
    • Re: [PATCH 1/2] audit: fix NUL handling in untrusted strings
      ... terminated string, it accepts a count. ... This is true, but it's only part of the problem, the string functions ... it is perfectly reasonable to stop at first NUL. ...
      (Linux-Kernel)
    • Re: rootkits
      ... in almost all windows programming systems the way of telling how ... This indicates the end of a string (a string being a word, letter, ... When you copy a string, usually you only copy up to the nul, a string copy, ... it in something like reg edit, reg edit will only show you the letters up to ...
      (microsoft.public.security)
    • Quantcast