We shoot in the foot, processing the input data

 3r3662. 3r3-31. 3r3640.
We shoot in the foot, processing the input data  3r3662. The link of today's article is different from the usual. This is not one project for which the source code was analyzed, but a series of positives of the same diagnostic rule in several different projects. What is the interest here? The fact that some of the considered code fragments contain errors that are reproduced during the work with the application, while others contain vulnerabilities (CVE). In addition, at the end of the article we discuss a bit about security defects.
 3r3662. 3r311. 3r3650.
 3r3662. 3r3618. A brief introduction to r3r3619.
 3r3662. All errors that will be considered today in the article have a similar pattern:
 3r3662.
 3r3662. 3r3-3593.  3r3662. 3r3-3598. The program accepts data from stream 3r3528. stdin [/i] ; 3r3599.  3r3662. 3r3-3598. checks the success of reading data; 3r3599.  3r3662. 3r3-3598. if the data is read successfully, the hyphen is removed from the string. 3r3599.  3r3662. 3r3601.
 3r3662. However, all the fragments that will be considered contain errors and are vulnerable to adjusted input. Since the data is received from the user, which may violate the logic of the application execution, there was a great temptation to try to break something. What I did.
 3r3662.
 3r3662. All the problems listed below were found to be PVS-Studio static analyzer. which looks for errors in the code not only for C, C ++, but also for C #, Java.
 3r3662.
 3r3662. Of course, finding a problem with a static analyzer is good, but finding and reproducing is a completely different level of pleasure. :)
 3r3662.
 3r3662. 3r3618. FreeSWITCH
 3r3662. The first suspicious code snippet was found in the module code 3r33528. fs_cli.exe [/i] included with the FreeSWITCH distribution:
 3r3662.
 3r3662. 3r? 3516. 3r? 3517. static const char * basic_gets (int * cnt)
{
3r3662. int c = getchar (); 3r3662. if (c < 0) {
if (fgets (command_buf, sizeof (command_buf) - ? stdin) 3r3662.! = command_buf) {
break; 3r3662.} 3rr6666. command_buf[strlen(command_buf)-1]= 'r3r3543. : V1010 r3r3650.
CWE-20
Unchecked tainted data is used in index: 'strlen (line)'.
 3r3662.
 3r3662. With another attempt, the problem was corrected by adding a check of the length of the input line:
 3r3662.
 3r3662. 3r? 3516. 3r? 3517. if (strlen (line)> 0)
if (line[strlen (line) - 1]== 'n')
line[strlen (line) - 1]= '
+ 0 -

Comments 1

Offline
PeterAllison 16 July 2019 11:01
While we've quite recently started to expose what's underneath, the important takeaway is to decide a procedure to catch your genuine outcomes information with the goal that you can reproduce shots sometime in the future. Regardless of whether you begin as basically as chronicle genuine rise modifications for various extents, you're moving the correct way. assignment writing services | AssignmentLand

Add comment