Our website uses cookies to enhance your browsing experience.
Accept
to the top
close form

Fill out the form in 2 simple steps below:

Your contact information:

Step 1
Congratulations! This is your promo code!

Desired license type:

Step 2
Team license
Enterprise license
** By clicking this button you agree to our Privacy Policy statement
close form
Request our prices
New License
License Renewal
--Select currency--
USD
EUR
* By clicking this button you agree to our Privacy Policy statement

close form
Free PVS‑Studio license for Microsoft MVP specialists
* By clicking this button you agree to our Privacy Policy statement

close form
To get the licence for your open-source project, please fill out this form
* By clicking this button you agree to our Privacy Policy statement

close form
I am interested to try it on the platforms:
* By clicking this button you agree to our Privacy Policy statement

close form
check circle
Message submitted.

Your message has been sent. We will email you at


If you haven't received our response, please do the following:
check your Spam/Junk folder and click the "Not Spam" button for our message.
This way, you won't miss messages from our team in the future.

>
>
>
Buffer overflow

Buffer overflow

Mar 31 2013

Buffer overflow is an issue when a program is writing or reading data outside the buffer allocated in memory for this purpose. It usually occurs because of incorrect data and memory handling when the programming subsystem and operating system don't provide strict protection against this error. This type of errors is rather frequent and usually caused by misprints. There is also a related error - buffer underflow.

The Buffer Overflow and Buffer Underflow errors often cause uninitialized data to be used in the program and, as a consequence, its undefined behavior. Buffer overflow may also cause segmentation faults (Access Violation).

Since most high-level languages arrange program data in the process stack mixing them with control data, exploiting buffer overflows is one of the most popular hacking methods, as it allows an intruder to load and execute any machine code for the program and have the rights of the user account under which the program is running.

In such popular languages as C and C++ there is no integrated check of data reading/writing boundaries. This is a sacrifice for the efficient low-level memory handling. On the other hand, almost all the interpretive languages and JIT environments (Java RTE, .NET Framework) have an internal protection against buffer overflow.

To prevent using the buffer overflow vulnerability when executing a program there exist stack-smashing protection systems (Libsafe, StackGuard) and executable space protection systems. The difficulty of dynamic buffer overflow detection is determined by the fact that the program might work stably for a long time as long as uninitialized memory stores suitable values and the writable memory area is not used. Static analysis allows to find buffer overflow errors and related loopholes at the stage of code writing/debugging.

Here are several examples of this error detected in the code of real open-source projects with the PVS-Studio static analyzer.

The MAME project (game emulator). Buffer overflow.

#define CHD_SHA1_BYTES 20
#define CHD_V4_HEADER_SIZE 108
#define CHD_MAX_HEADER_SIZE CHD_V4_HEADER_SIZE

static chd_error header_read(...., chd_header *header)
{
  UINT8 rawheader[CHD_MAX_HEADER_SIZE];
  ...
  memcpy(header->parentsha1, &rawheader[100], CHD_SHA1_BYTES);
  ...
}

The 'rawheader' array consists of 108 bytes. The programmer intended to copy its contents starting with byte 100. The trouble is we will get outside the array boundaries: we're copying 20 bytes, while its only 8 bytes that can be copied.

Now consider an example of buffer underflow error. This is the Chromium project.

void Time::Explode(..., Exploded* exploded) const {
  ...
  ZeroMemory(exploded, sizeof(exploded));
  ...
}

The ZeroMemory function clears only a part of the Exploded structure. The reason is that the 'sizeof' operator returns the pointer size. We need to dereference the pointer to fix the error.

ZeroMemory(exploded, sizeof(*exploded));

Other samples of errors and vulnerabilities detected with the help of the static analysis methodology can be found here.

References

Popular related articles


Comments (0)

Next comments next comments
close comment form