로그인

검색

C/C++
2013.07.28 02:42

Buffer Overrun

MoA
조회 수 1349 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 게시글 수정 내역 댓글로 가기 인쇄
How does one patch or prevent a BufferOverRun??

From the start - don't stuff more bytes into a buffer than it can hold.

More specifically (this applies to C/C++; a lot of these problems don't occur in other languages):

  • If writing code in C++, use the string class rather than char[] for strings whenever performance isn't a priority.
  • Never use gets() -- always use fgets()
  • Never use sprintf(), use snprintf() instead
  • Never use strcpy(), use strncpy() instead
  • Never use strcat(), use strncat() instead
  • Never use printf (foo) to print a raw string; always use printf ("%s", foo). Especially important if foo is a string generated by a user. One class of attacks is to embed nasty formatting controls (like %n) in a string, trying to cause a buffer overflow. (See FormatStringVulnerability?)
  • If you have to use char[] rather than string, keep track of your buffer lengths.
  • Never assume a 4K or other size buffer is "long enough"... chances are it won't be.
  • Use dynamic char buffers, and DoubleAfterFull to maintain good performance.

The best way to avoid buffer overruns and the related list overruns and list jams is to make a religion of testing your boundary conditions, testing your boundary assumptions and, most important, any programmer whose code allows them should be subjected to the most severe ridicule and humiliation the team's culture will allow. Dunce caps are easy to make and very effective.


위키링크 추가 http://en.wikipedia.org/wiki/Buffer_overflow

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
공지 Tool/etc Programming 게시판 관련 2 MoA 2014.11.01 5316
208 API/MFC Visual C++ 시리얼 통신(RS-232) 강좌 (1) MoA 2013.07.28 7134
207 API/MFC Visual C++ 시리얼 통신(RS-232) 강좌 (2) 1 MoA 2013.07.28 5365
206 API/MFC CString class MoA 2013.07.28 952
205 Site 이미지공학(IE) 연구실 MoA 2013.07.28 652
204 API/MFC MFC TIP MoA 2013.07.28 988
203 Graphic Video Preview and Frames Capture MoA 2013.07.28 1706
202 Graphic DirectX 9.0c SDK을 Visual Studio2008에 적용방법 MoA 2013.07.28 706
201 API/MFC #pragma MoA 2013.07.28 836
200 C/C++ 비트연산자 MoA 2013.07.28 1171
199 Site 알고리즘 정리된 블로그 MoA 2013.07.28 718
198 C/C++ C언어의 변수 float와 double - Float Point 처리 MoA 2013.07.28 1015
197 C/C++ C 언어의 문자형 변수 char - 8비트 정수형 변수 MoA 2013.07.28 2838
196 API/MFC DoModal Dialog 기초 MoA 2013.07.28 862
195 API/MFC 모달창 세팅값 저장 MoA 2013.07.28 798
194 API/MFC 후킹 링크 MoA 2013.07.28 1510
193 C/C++ Binary 데이터 저장 by Google MoA 2013.07.28 1172
192 C/C++ fwrite(), fread() MoA 2013.07.28 1361
191 C/C++ Google의 C++ 라이브러리 MoA 2013.07.28 1433
» C/C++ Buffer Overrun MoA 2013.07.28 1349
189 C/C++ Simplified Logger Class MoA 2013.07.28 1230
Board Pagination Prev 1 2 3 4 5 6 7 8 9 10 ... 15 Next
/ 15