로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 3519 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 15455
298 LLM 알리바바, 딥시크·오픈AI 넘는 추론 모델 출시..."오픈 소스 최강 입증" (QwQ-32B) OBG 2025.03.10 1205
297 Deeplearning 존 카맥이 일리야 수츠키버를 4년전에 만났을때, 추천받은 책과 논문 목록 OBG 2025.02.18 1339
296 Site 2024년 가장 조회수 높은 소프트웨어 엔지니어링 발표들 OBG 2025.02.18 1406
295 Tool/etc OS 개발에 관한 작은 책 OBG 2025.03.24 1441
294 LLM AI-hub 공공데이터를 활용하여 한국어-영어 번역 LLM 만들기 OBG 2025.01.14 1570
293 LLM llama3 implemented from scratch OBG 2024.05.24 1619
292 LLM 얼렁뚱땅 LLM을 만들어보자 OBG 2025.01.10 1650
291 LLM PEFT: Parameter-Efficient Fine-Tuning of Billion-Scale Models on Low-Resource Hardware OBG 2024.04.15 1681
290 LLM A Beginner's Guide to Prompt Engineering with GitHub Copilot OBG 2024.04.04 1785
289 Tool/etc GDB Dashboard OBG 2025.01.14 1809
288 Tool/etc GitHut Copilot - Agent 모드 공개 OBG 2025.02.14 1870
287 Tool/etc OS in 1,000 Lines OBG 2025.01.14 1879
286 서버 Caching in Node.js to optimize app performance OBG 2023.01.16 1939
285 서버 Debugging Node.js Memory Leaks: How to Detect, Solve or Avoid Them in Applications OBG 2023.07.04 1944
284 Tool/etc 나이 들어가는 프로그래머 - [발표영상] 요약 OBG 2025.02.14 2009
283 Deeplearning PyTorch 딥러닝 챗봇 OBG 2023.07.04 2141
282 LLM Mixture of Experts - Part 2 OBG 2024.04.14 2141
281 Web Creating A Fixed-Length Queue In JavaScript Using Arrays OBG 2022.09.14 2195
280 서버 멀티-플레이어 게임 서버와 레이턴시 보상 테크닉 OBG 2024.01.16 2203
279 서버 Design a Basic Search Engine (Google or Bing) | System Design Interview Prep OBG 2023.05.27 2207
Board Pagination Prev 1 2 3 4 5 6 7 8 9 10 ... 15 Next
/ 15