메뉴 건너뛰기

OBG

Programming

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 379 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 1597
27 C/C++ 파일 입출력 MoA 2013.07.28 452
26 C/C++ 코드 실행 시간 계산 Naya 2012.08.02 268
25 C/C++ 코드 실행 시간 계산 Naya 2012.09.27 464
24 C/C++ 정신나간 정렬 알고리즘 file MoA 2015.10.13 549
23 C/C++ 비트연산자 MoA 2013.07.28 310
22 C/C++ 고수가 절대 알려주지 않는 C/C++ 팁 너울 2011.09.23 345
21 C/C++ Simplified Logger Class MoA 2013.07.28 393
20 C/C++ RAND_MAX 2 MoA 2014.01.19 377
19 C/C++ printf Type Field Characters 너울 2012.02.23 291
18 C/C++ ofstream ifstream MoA 2013.07.28 494
17 C/C++ memset vs for 초기화. 속도 차이가 얼마나 날까? 2 MoA 2013.07.28 663
16 C/C++ Google의 C++ 라이브러리 MoA 2013.07.28 461
15 C/C++ fwrite(), fread() MoA 2013.07.28 593
14 C/C++ fopen 함수가 Multi Thread 에서 안전한가? MoA 2013.07.28 562
13 C/C++ extern "C" 에 관하여 MoA 2013.07.28 295
12 C/C++ Essential C 링크 너울 2011.08.31 264
11 C/C++ Data Conversions MoA 2013.07.28 590
10 C/C++ C언어의 변수 float와 double - Float Point 처리 MoA 2013.07.28 684
9 C/C++ C++의 새로운 표준, C++0x에서 C++11으로 너울 2011.10.15 286
8 C/C++ C++에서 base64로 인코딩 Naya 2012.11.15 597
Board Pagination Prev 1 ... 2 Next
/ 2
위로