6

I have a function that returns a string:

const *char getMyPassword()
{
    return "mysecretpassword";
}

Well, it worked perfectly, but I discovered that if I would run "strings" on Unix systems it shows up in the list.. not good.

What is the easiest possible way to replace it? The function sits in a library and I want to keep it flexible. I now started mallocing within the function and the string in strings disappeared. However, when would I free it again?

char * getMyPassword()
{
unsigned char arr[] = { 'p', 'a', 's', 's', 'w', 'o', 'r' , 'd', '\0' };
char *return_arr = malloc(sizeof(arr));
strcpy(return_arr, arr);
return return_arr;

}

If I was to malloc before and pass a pointer, then how could I have known the size before as the passwords size is only known within the function?

As a plan B I could pass a huge array, but that seems not very elegant. How should I approach this?

EDIT: I added the strcpy(return_arr, arr). I actually had it in the original code, but forgot it in here.

Improve this question
9
  • Put it in there backward, then use strrev(). Or, rot-13 it twice. Commented Oct 11, 2011 at 22:32
  • 6
    If you're going to be using passwords, I strongly recommend using hashed passwords instead of the literal string. That will definitely decrease the amount of information that someone can obtain by running 'strings' on the program. You can customize a hash function so that people can't (or at least its much harder) determine what the value actually is. Commented Oct 11, 2011 at 22:33
  • For what purpose should the password be used? A Login somewhere or such? Commented Oct 11, 2011 at 22:41
  • The password is used to access my MySQL database. The database contains sensitive customer data. Commented Oct 11, 2011 at 22:44
  • The server and development environment use different passwords which is why I need the flexibility and put it into a library. Commented Oct 11, 2011 at 22:45

5 Answers 5

Reset to default
2

Security issues aside, what you are trying to do is dynamically allocate buffer.

You can take 2 approaches.

  1. Always malloc inside your function and document it that it returns malloced result.
  2. Follow the road of some standard library functions, require that user pass a pointer to a valid buffer and its size and return the size actually copied. Some of these functions allow the check pass, when you pass in a null buffer, they do not try to allocate it, but instead return the size that is required to hold the structure.

Looks to me that you've already implemented approach #1.

For approach #2 use this signature:

int getMyPassword( char* buffer, size_t buff_size, size_t* p_num_copied )
{
  unsigned char arr[] = { 'p', 'a', 's', 's', 'w', 'o', 'r' , 'd', '\0' };

  if ( buffer == 0 )
  {
    *p_num_copied = sizeof(arr);
    return SUCCESS;
  }

  if ( buff_size < sizeof(arr) )
  {
    *p_num_copied = sizeof(arr);
    return BUFFER_TOO_SMALL;
  }

  memcpy( buffer, arr, sizeof(arr) );

  *p_num_copied = sizeof( arr );

  return SUCCESS;
}

Advantage of method #2 is that the caller, in many cases, may allocate the buffer on stack, especially if you advertise the maximum required buffer size. Another advantage is that memory management is now completely handled by client. In general purpose library you don't want to make a client depending on a particular library memory allocation schema.

IN REPLY TO COMMENT

If you always want to use allocated value in your client code, then this is how I would do this:

char* clientGetPasswordFromLibrary( )
{
  // in our day and age it's fine to allocate this much on stack
  char buffer[256];
  size_t num_copied;

  int status = getMyPassword( buffer, sizeof(buffer), &num_copied );

  char* ret_val = NULL;

  if ( status == BUFFER_TOO_SMALL )
  {
    ret_val = malloc( num_copied );

    if ( ret_val == NULL )
    {
      return NULL;
    }

    getMyPassword( ret_val, num_copied, &num_copied );
  }
  else
  {
    ret_val = malloc( num_copied );

    if ( ret_val == NULL )
    {
      return NULL;
    }

    memcpy( ret_val, buffer, num_copied );
  }

  return ret_val;
}
Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

I once read that it is bad practice to malloc something and then return it which is why I always tried to refrain from doing that. So thanks for your 2nd approach Alex. What do you think about passing the buffer and then reallocating it?
@Frank. If in your client code you always want to rely on malloc, that's fine. I will edit the answer to show you an example of how I would do this.
2

I think the problem here is, you're trying to return a pointer to a variable which is locally defined when you're trying to return a string like that. I'd expect your first function to work, since the pointer returns the address to a literal, which is static through the execution of the program. Similarly, you could declare the the char [] variable in your local scope to be static; so that it's not in the local scope.

But honestly, I do not understand why you'd want a function to return a pointer to a string literal; when you can simply define the literal outside the local scope, where it is actually needed.

Improve this answer

1 Comment

The reasons is that the function sits in a library that I load dynamically at runtime. I'm doing this because my live system uses a different password than the test system.
2

I have a few ideas:

  1. Store the hashed version of the password. In getMyPassword(), unhash the variable and return it.

  2. Store the password in a protected file (encrypted, with read permissions for only your user, etc). Load the password from the file and return in in your function.

  3. Combine 1 and 2 - store the hashed password in the protected file, unhash it and return it.

It all depends on how secure you want to be.

Improve this answer

1 Comment

I really like the idea and used your rot13 hasher already. I put it into the library encrypted and it is decrypted in the binary where it is needed. I left it in the array style to make sure no one can simply use string. I wanted to try now, if I can apply different permissions to libraries as well without breaking my existing app.
1

It is a more or less futile (you know, anyone reverse-ingeneering your program can get the password easily) steganography exercise. You can, for example, to enhance a little bit more the security, do the following:

  1. Select a "seed" value to be XOR'ed with all the characters.
  2. Do the getMyPassword function to accept that character. This way, the function is mostly useless if you don't know the seed.

So, for example, take the value 55 as your seed. You can have something like:

char * getMyPassword(char seed)
{
const char* str = "SEX@DDVG";
char *return_arr = malloc(9); /* 8+1 */
for (int i=0 ; i < 9 ; ++i)
   return_arr[i] = str[i] ^ seed;
return_arr[i] = 0;
return return_arr;
}

and you have to call getMyPassword(55) to get the correct result. I swear, the number 55 was chosen at random, and I don't know what DDVG is :)

Improve this answer

2 Comments

Very simple and effective. thanks for your advice Diego. I might combine it as I just addded a very simple rot13 hasher.
This is too easy. If I looked at the public symbols of a library and saw a function getMyPassword, I'd double my efforts to disassemble that function. If I'm later rewarded with with customer data like credit card information ... There must be another way to get that password into the program. I would open /dev/tty after program start and read it from keyboard. Putting it into a lib or a config-file is too insecure.
0

In regard to the security issues, A common way to pass passwords securely to a process is using the environment. For instance, if your program is eventually called from a web page you can set the password once in the secure apache config files (via SetEnv PASSWORD "secret") and it will be passed down to every cgi script it runs, and whatever they run. Then in your program you only need to embed getenv("PASSWORD").

A common mistake is to accept passwords on the command line of a program, this should not be done because the command line can be accessed by any process in /proc. This is how 'ps' can show what is running for instance.

Also, you can set your programs permission to executable but not readable (chmod -r+x program). So it can be run but its contents can not actually be read. Always a good idea for anything in your web serving tree to avoid exposing things by accident via a server configuration error. Whether this works for shell scripts is implementation dependent but it will work for compiled programs.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.