Secure Coding in C and C++ (Part 2)

SECURE CODING IN C AND C++ (Part 2)

NEVER USE GETS

Never use gets(). Because it is impossible to tell without knowing the data in advance how many characters gets() will read, and because gets() will continue to store characters past the end of the buffer, it is extremely dangerous to use. It has been used to break computer security. Use fgets() instead.

For more information, see CWE-242 (aka “Use of Inherently Dangerous Function”) at http://cwe.mitre.org/data/definitions/242.html

1
2
3
4
5
6
7
8
9
10
11
12
13

#include<stdio.h>
#include<string.h>

int main(){

    char buffer[16];
    printf("Enter some data.\n");

    gets(buffer); // dangerous

    puts(buffer);

}

file COMMAND

The file a.out (in this example) is a 64-bit executable designed for Linux systems using the x86-64 architecture. It is a shared object (dynamic library) that relies on other libraries to run. The file is dynamically linked, meaning it loads necessary libraries when executed. It uses the system’s default dynamic linker located at /lib64/ld-linux-x86-64.so.2. The file is not stripped, so it includes extra debugging information to help developers.

1
2

file a.out
a.out: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=c582a65ab5e05c2a46cba44757820a2515627ab0, for GNU/Linux 3.2.0, not stripped

DISABLING PROTECTION DURING GCC COMPILATION

1

gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie -m64

Here’s what each part of this command does:

• -fno-stack-protector
  Disables “stack protection,” a security feature that detects changes to the stack (where functions store temporary data).

  Turning this off makes the program more vulnerable to buffer overflow attacks.

• -z execstack
  Allows the stack to execute code, which is typically disallowed to prevent certain types of attacks.

• -no-pie
  Disables “Position Independent Executable” (PIE), which normally randomizes where code runs in memory to make attacks more difficult.

• -m64
  Compiles the program as a 64-bit executable.

Check Security:

checksec --file=vuln