로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 3518 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 15455
98 Tool/etc What does set -e mean in a bash script? OBG 2021.04.29 3368
97 Tool/etc What does the last “-” (hyphen) mean in options of `bash`? OBG 2021.04.29 2797
96 JAVA/Android What to use instead of “addPreferencesFromResource” in a PreferenceActivity? MoA 2013.06.13 2979
95 Database What's the difference between comma separated joins and join on syntax in MySQL? OBG 2022.06.09 2777
94 API/MFC Which Font is the default for MFC Dialog Controls MoA 2013.06.12 3345
93 Library Win32 Socket Class Naya 2012.08.02 3593
92 API/MFC Windows 10 앱 개발(UWP) MoA 2015.10.13 3383
91 API/MFC WTL 정리 file MoA 2013.12.22 3581
90 JAVA/Android XML 파싱하기 MoA 2013.08.06 8945
89 Deeplearning 강화학습 학습 관련 정리 OBG 2022.08.10 2854
88 Site 개발에 도움되는 사이트 (초보 개발자 꿀팁) OBG 2023.01.28 2491
87 Site 개발자를 위한 각 기업 오픈소스 공유 사이트 (주로 모바일) Naya 2012.08.02 3690
86 Site 검색엔진 개발자 그룹 MoA 2013.08.30 2758
85 C/C++ 고수가 절대 알려주지 않는 C/C++ 팁 너울 2011.09.23 2972
84 Python 고양이 밖으로 못나가게 하기 file MoA 2013.11.10 3421
83 Python 고양이 움직이기 1 file MoA 2013.11.08 3444
82 Algorithm 구글 검색 알고리즘의 원리 Naya 2012.08.02 3313
81 Tool/etc 나이 들어가는 프로그래머 - [발표영상] 요약 OBG 2025.02.14 2009
80 Deeplearning 내 마음대로 선정한 머신러닝/딥러닝 학습 추천 서적 OBG 2023.08.14 2909
79 API/MFC 다국어를 위한 StringTable, LoadString 1 MoA 2013.12.22 4887
Board Pagination Prev 1 ... 6 7 8 9 10 11 12 13 14 15 Next
/ 15