Re: Stack growth direction to thwart buffer overflow attacks
From: Frank Cusack (fcusack_at_fcusack.com)
Date: 08/19/03
- Next message: Frank Cusack: "Re: Stack growth direction to thwart buffer overflow attacks"
- Previous message: Security Alert: "SSRT3531 Potential Security Vulnerability in sendmail (rev.8)"
- In reply to: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Next in thread: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Reply: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 19 Aug 2003 06:38:26 -0700
On Tue, 19 Aug 2003 07:57:42 +0000 (UTC) phn@icke-reklam.ipsec.nu wrote:
> In comp.security.misc Frank Cusack <fcusack@fcusack.com> wrote:
>> On Sat, 16 Aug 2003 13:05:20 -0400 Tony Nelson <tonynlsn@shore.net> wrote:
>>> Surely not. I prefer to use:
>>>
>>> target[0] = 0;
>>> strncat(target,source,sizeof(target));
>>>
>>> strncat puts a NUL at the end of the string.
>
>> No, it doesn't. This is a prime example of what I think is a worse
>> problem than the wrong language (C), it's not understanding how to
>> use the API.
>
> Quoting from FreeBSD's manpage for strncat(3) :
...
FreeBSD is not the standard. Prior to C99, strn* implemenatations were
at the implementor's whim. Ahh ... that bit of info might shed some
light on why it stinks. C99 may have tried to accomodate the various
de facto implementations already in existence, rather than DTRT.
If you want to write correct programs, you cannot refer to vendor
documentation for standard libraries as your baseline. You have to
start with the standard docs (although H&S or K&R generally suffice)
and then make variations for each platform.
It just so happens that I am very aware of strn* problems. Many (most?)
aren't. You shouldn't have to be a friggin expert to be able to use
the language safely. With C, you do have to be an expert.
I'm sure you yourself are an experienced programmer. Only someone of
some reasonable level of knowledge would quote a manpage back to me.
And even you don't know how to use strn* correctly. See how hard it
is?
>> Why strn* were designed so poorly is another question.
>
> Maybe some reading will make this clear ?
Reading of what? C99 committee member's minds?
/fc
- Next message: Frank Cusack: "Re: Stack growth direction to thwart buffer overflow attacks"
- Previous message: Security Alert: "SSRT3531 Potential Security Vulnerability in sendmail (rev.8)"
- In reply to: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Next in thread: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Reply: phn_at_icke-reklam.ipsec.nu: "Re: Stack growth direction to thwart buffer overflow attacks"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
