Example code for common software security vulnerabilities

Buffer overflow:

1Example1.1:2         ...3     CharBuf[bufsize];4Gets (BUF);//User Control5     ...6 7Example1.2(C + +):8     ...9     CharBuf[bufsize];TenCin >> (BUF);//User Control One     ... A  - Example2: -     ... the     Charbuf[ -],inch[max_size]; -printf"Enter Buffer contents:\n"); -Read0,inch, max_size-1); -printf"Bytes to copy:\n"); +scanf"%d", &bytes);//User Control -memcpy (BUF,inch, bytes); +     ... A     Char*lccopy (Const Char*str) { at         CharBuf[bufsize]; -         Char*p; -      - strcpy (buf, str); -          for(p = buf; *p; p++) { -              if(Isupper (*p)) { in*p = ToLower (*p); -             } to         }     +         returnStrDup (BUF); -     } the  * Example4: $     if(! (Png_ptr->mode &Png_have_plte)) {Panax Notoginseng         /*should be a error, but we can cope with it*/ -Png_warning (Png_ptr,"Missing Plte before Trns"); the     } +     Else if(Length > (png_uint_32) png_ptr->Num_palette) { APng_warning (Png_ptr,"incorrect trns chunk length"); the png_crc_finish (png_ptr, length); +         return; -     } $     ... $ Png_crc_read (Png_ptr, Readbuf, (png_size_t) length); -  - Example5: the     voidGetUserInfo (Char*username,struct_user_info_2 INFO) { -WCHAR unicodeuser[unlen+1];WuyiMultiByteToWideChar (CP_ACP,0, username,-1, theUnicodeuser,sizeof(Unicodeuser)); -NetUserGetInfo (NULL, Unicodeuser,2, (LPBYTE *) &info); Wu}

Format string:

1 Example1:2     intMainintargcChar**argv) {3         Charbuf[ -];4         ...5snprintf (BUF, -, argv[1]);6     }7 8 Example2:9printf"%d%d%1$d%1$d\n",5,9);Ten  One Example3: A     ... - syslog (Log_err, cmdbuf); -     ... the  - Example4: -#include <stdio.h> -  + voidPrintwrapper (Char*string) {    -printfstring); + } A  at intMainintargcChar**argv) {    -   Charbuf[5012];  -memcpy (BUF, argv[1],5012);  -Printwrapper (argv[1]);  -   return(0); -}

Integer overflow:

Example1: Short intBytesrec =0;CharBuf[somebignum]; while(Bytesrec <maxget) {Bytesrec+ = Getfrominput (buf+bytesrec);} Example2:nresp=Packet_get_int (); if(Nresp >0) {Response= Xmalloc (nresp*sizeof(Char*));  for(i =0; i < Nresp; i++) Response[i]=packet_get_string (NULL); }example3:Char* Processnext (Char*strm) {     Charbuf[ +];  ShortLen = * ( Short*) Strm; STRM+=sizeof(len); if(Len <= +) {memcpy (buf, STRM, Len);      Process (BUF); returnSTRM +Len; } Else {      return-1; }}example4:[email protected]~/labs/integer $ cat add.c#include<stdio.h>#include<limits.h>intMainvoid){ intA;//a=2147483647;A=Int_max; printf ("int A (INT_MAX) =%d (0x%x), int a (INT_MAX) + 1 =%d (0x%x) \ n", a,a,a+1, A +1); return 0;} [Email protected]~/labs/integer $./AddintA (Int_max) =2147483647(0x7fffffff),intA (Int_max) +1= -2147483648(0x80000000) Example5:[email protected]~/labs/integer $ cat multiplication.c#include<stdio.h>#include<stdlib.h>#include<unistd.h>#include<string.h>intMainintargcChar**argv) { intI, J, z=0x00000001; Char*tab;if(argc<2) _exit (1); I=atoi (argv[1]); if(i>0) {tab= malloc (i *sizeof(Char*)); if(tab = = NULL) _exit (2); }  for(j=0; j<i; J + +) Tab[j]=z++;  for(j=0; j<i; J + +) printf ("tab[j]=0x%x\n", Tab[j]); return 0;} [Email protected]~/labs/integer $./multiplication1073741824Segmentation Fault

Example code for common software security vulnerabilities