로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 3519 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 15455
178 Tool/etc 잡담) AWS에 서버 띄워 놓으니 벼라별 리퀘스트가 다 날아 오네요 OBG 2023.03.11 3291
177 Python [액션게임 만들기] 4. 캐릭터 선택 화면 file OBG 2014.05.07 3290
176 Deeplearning Stable Diffusion OBG 2022.09.27 3287
175 Tool/etc Quake 3 source code and review MoA 2014.01.15 3284
174 API/MFC 작업자 스레드(Worker Thread) 와 사용자 인터페이스 스레드(User Interface Thread) MoA 2013.07.28 3283
173 Python [농장게임 만들기] 5. 플레이어를 추가하자 1 file MoA 2014.04.30 3262
172 API/MFC Property Sheet의 버튼 속성 변경하기 MoA 2013.07.25 3260
171 Library ChartFX 7.0 MFC에서 사용하기 MoA 2013.07.28 3243
170 Algorithm 동적 프로그래밍 Naya 2012.08.13 3241
169 API/MFC Deploying a Visual C++ Application (배포 방법) Naya 2012.08.02 3235
168 Site CSS, 자바스크립트 강좌 MoA 2013.11.05 3233
167 STL/Boost 정적 배열과 STL vector 속도 비교 MoA 2013.07.28 3232
166 Deeplearning 추천 시스템 OBG 2023.03.30 3226
165 C/C++ fwrite(), fread() MoA 2013.07.28 3221
164 Tool/etc [S/W 공학] 월-인원(man-month), LOC MoA 2013.09.23 3215
163 JAVA/Android 리스트뷰에 체크박스 추가 예제 MoA 2013.05.24 3211
162 Python [첫게임 만들기] 8. Win or Lose file MoA 2013.11.21 3209
161 API/MFC 모달리스 대화상자 Naya 2012.08.02 3207
160 API/MFC Serial Communication in MFC 너울 2011.08.25 3206
159 Python [액션게임 만들기] 9. 캐릭터 액션 구현 2 MoA 2014.05.07 3201
Board Pagination Prev 1 2 3 4 5 6 7 8 9 10 11 ... 15 Next
/ 15