로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 3518 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 15455
178 Tool/etc Redmine 설치 MoA 2013.07.28 3330
177 API/MFC unsigned char <-> 유니코드(unicode) 및, string 변환 매크로 - USES_CONVERSION MoA 2013.07.28 4776
176 C/C++ memset vs for 초기화. 속도 차이가 얼마나 날까? 2 MoA 2013.07.28 3054
175 C/C++ fopen 함수가 Multi Thread 에서 안전한가? MoA 2013.07.28 3391
174 API/MFC __cdecl , __pascal, __stdcall MoA 2013.07.28 3465
173 Tool/etc 컨텍스트 스위칭 (Context Switching) MoA 2013.07.28 3684
172 API/MFC HWND와 HINSTANCE MoA 2013.07.28 3607
171 Library pthread MoA 2013.07.28 2627
170 STL/Boost 정적 배열과 STL vector 속도 비교 MoA 2013.07.28 3232
169 Tool/etc 에디트 플러스, VS 2008 컴파일 환경 설정 MoA 2013.07.28 3355
168 Library ChartFX 7.0 MFC에서 사용하기 MoA 2013.07.28 3243
167 Tool/etc Coding conventions MoA 2013.07.28 4045
166 Site GOF 디자인패턴 정리 MoA 2013.07.28 2753
165 Tool/etc Design Patterns Quick Reference MoA 2013.07.28 2727
164 Tool/etc 예외 처리 가이드 (Slide) MoA 2013.07.28 3017
163 API/MFC Legacy MFC 어플리케이션을 MFC feature pack으로 포팅 MoA 2013.07.30 2672
162 JAVA/Android XML 파싱하기 MoA 2013.08.06 8945
161 API/MFC 리스트 컨트롤에 체크박스 추가 MoA 2013.08.14 4645
160 Tool/etc 앱 디자인의 발견 - 메모 서비스를 생각하다 MoA 2013.08.17 2992
159 C/C++ C++11 A cheat sheet MoA 2013.08.21 3414
Board Pagination Prev 1 2 3 4 5 6 7 8 9 10 11 ... 15 Next
/ 15