Buffer Overflow; Avoiding overflow attacks

Question

I'm looking at this code example for class and I am new with buffer overflows. How can this exmple be modified to avoid buffer overflow attacks? Also, If anyone knows of a good article on buffer overflows, please post it. Thanks!

void GetProfileFor( const char *name,
              char *profile,
              int profileLen );

int main() {
              char *profile = malloc( 1024 );
              char name[128];

              printf( “Enter your name: ” );
              gets( name );

              GetProfileFor( name, profile, 1024 );
              printf( “\nYour profile: %s\n”, profile );
return 0; }

Peter Teoh · Accepted Answer · 2014-04-13 03:19:43Z

2

To identify where buffer overflow will occur you will have to identify all the input path and the buffer it filled up - is the internal buffer sufficient to cater for all poissible input? Or is there any limits imposed on the amount of inputs allowed?

In your case the gets(name) has a limit in internal buffer, but gets() itself has no limits in the input it can take:

http://www.tutorialspoint.com/c_standard_library/c_function_gets.htm

therefore buffer overflow is possible.

The specific solution to prevent this attack is to use fgets():

http://www.tutorialspoint.com/c_standard_library/c_function_fgets.htm

which does have a limit placed on the external inputs allowed.

answered Apr 13, 2014 at 3:19

Peter Teoh

6,8634 gold badges46 silver badges59 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

R Sahu · Accepted Answer · 2014-04-13 03:22:19Z

1

Looking at just the code you posted, I found one line of code that you can change.

Replace

gets(name);

with

fgets(name, 128, stdin);

gets does not check the size of name to decide when to stop reading. It will try to read more characters than name has space for. fgets, on the other hand, will stop reading when it encounters a newline or it has read 127 characters, whichever is first.

Checkout Why gets() is bad / Buffer Overflows for more details.

edited Apr 13, 2014 at 3:22

answered Apr 13, 2014 at 3:14

R Sahu

207k15 gold badges168 silver badges291 bronze badges

1 Comment

M.M Over a year ago

Some robustness can be added, fgets(name, sizeof name, stdin). Then a buffer overflow can't be caused by later deciding to make the buffer smaller.

BitFriends · Accepted Answer · 2019-11-01 21:36:52Z

1

The most new compilers are adding stack protectors eg. canaries to the binary. You can still overflow the buffer, but you cant jump to the stack and execute shellcode and etc. You could brute force the canary, but it would probably take a long time. Also when you look at the man page of gets, in the bug section it says never use fgets

edited Nov 1, 2019 at 21:36

answered Oct 31, 2019 at 21:41

BitFriends

3891 gold badge8 silver badges22 bronze badges

Collectives™ on Stack Overflow

Buffer Overflow; Avoiding overflow attacks

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related