로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 2597 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

  1. Programming 게시판 관련

    Date2014.11.01 CategoryTool/etc ByMoA Views9350
    read more
  2. Visual C++ 시리얼 통신(RS-232) 강좌 (1)

    Date2013.07.28 CategoryAPI/MFC ByMoA Views8361
    Read More
  3. Visual C++ 시리얼 통신(RS-232) 강좌 (2)

    Date2013.07.28 CategoryAPI/MFC ByMoA Views6191
    Read More
  4. CString class

    Date2013.07.28 CategoryAPI/MFC ByMoA Views2060
    Read More
  5. 이미지공학(IE) 연구실

    Date2013.07.28 CategorySite ByMoA Views1984
    Read More
  6. MFC TIP

    Date2013.07.28 CategoryAPI/MFC ByMoA Views1893
    Read More
  7. Video Preview and Frames Capture

    Date2013.07.28 CategoryGraphic ByMoA Views2769
    Read More
  8. DirectX 9.0c SDK을 Visual Studio2008에 적용방법

    Date2013.07.28 CategoryGraphic ByMoA Views1630
    Read More
  9. #pragma

    Date2013.07.28 CategoryAPI/MFC ByMoA Views1685
    Read More
  10. 비트연산자

    Date2013.07.28 CategoryC/C++ ByMoA Views2149
    Read More
  11. 알고리즘 정리된 블로그

    Date2013.07.28 CategorySite ByMoA Views1866
    Read More
  12. C언어의 변수 float와 double - Float Point 처리

    Date2013.07.28 CategoryC/C++ ByMoA Views2081
    Read More
  13. C 언어의 문자형 변수 char - 8비트 정수형 변수

    Date2013.07.28 CategoryC/C++ ByMoA Views3948
    Read More
  14. DoModal Dialog 기초

    Date2013.07.28 CategoryAPI/MFC ByMoA Views1765
    Read More
  15. 모달창 세팅값 저장

    Date2013.07.28 CategoryAPI/MFC ByMoA Views1922
    Read More
  16. 후킹 링크

    Date2013.07.28 CategoryAPI/MFC ByMoA Views2897
    Read More
  17. Binary 데이터 저장 by Google

    Date2013.07.28 CategoryC/C++ ByMoA Views2197
    Read More
  18. fwrite(), fread()

    Date2013.07.28 CategoryC/C++ ByMoA Views2357
    Read More
  19. Google의 C++ 라이브러리

    Date2013.07.28 CategoryC/C++ ByMoA Views2231
    Read More
  20. Buffer Overrun

    Date2013.07.28 CategoryC/C++ ByMoA Views2597
    Read More
  21. Simplified Logger Class

    Date2013.07.28 CategoryC/C++ ByMoA Views2244
    Read More
Board Pagination Prev 1 2 3 4 5 6 7 8 9 10 ... 15 Next
/ 15

Sketchbook5, 스케치북5

Sketchbook5, 스케치북5

나눔글꼴 설치 안내


이 PC에는 나눔글꼴이 설치되어 있지 않습니다.

이 사이트를 나눔글꼴로 보기 위해서는
나눔글꼴을 설치해야 합니다.

나눔고딕 사이트로 가기

Sketchbook5, 스케치북5

Sketchbook5, 스케치북5