로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 3519 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 15455
98 Graphic DirectX 9.0c SDK을 Visual Studio2008에 적용방법 MoA 2013.07.28 2471
97 Graphic Direct3D 9 compile MoA 2013.07.28 2615
96 Tool/etc Design Patterns Quick Reference MoA 2013.07.28 2727
95 서버 Design a Basic Search Engine (Google or Bing) | System Design Interview Prep OBG 2023.05.27 2207
94 API/MFC Deploying a Visual C++ Application (배포 방법) Naya 2012.08.02 3235
93 Web defer, async 스크립트 OBG 2023.01.10 2248
92 서버 Debugging Node.js Memory Leaks: How to Detect, Solve or Avoid Them in Applications OBG 2023.07.04 1944
91 C/C++ Data Conversions MoA 2013.07.28 3398
90 C/C++ C언어의 변수 float와 double - Float Point 처리 MoA 2013.07.28 2589
89 API/MFC CString class MoA 2013.07.28 3382
88 Site CSS, 자바스크립트 강좌 MoA 2013.11.05 3233
87 Library CSpreadSheet MoA 2014.02.03 2911
86 Web Creating A Fixed-Length Queue In JavaScript Using Arrays OBG 2022.09.14 2195
85 API/MFC CreateThread와 AfxBeginThread의 차이 너울 2011.09.26 4750
84 API/MFC CreateThread, ExitThread, GetExitCodeThread ... MoA 2013.07.28 3442
83 API/MFC CPaneDialog의 context menu 안뜨게 하기 MoA 2013.06.12 3559
82 API/MFC CPaneDialog 초기화 (OnInitDialog) MoA 2013.07.18 4091
81 LLM Comparing Replit and Cursor for AI-Powered Coding OBG 2024.09.21 2496
80 Tool/etc Coding conventions MoA 2013.07.28 4045
79 LLM ChatGPT의 강력한 경쟁 언어모델 등장!, Mixtral 8x7B OBG 2024.04.14 2517
Board Pagination Prev 1 ... 6 7 8 9 10 11 12 13 14 15 Next
/ 15