Embedded Toolchain. 1 C/C++-Grundlagen. strncpy_s, strcpy_s etc. V 4.02; Hon. Prof. Helmke 1

Transkript

1 1 C/C++-Grundlagen strncpy_s, strcpy_s etc. V 4.02; Hon. Prof. Helmke 1

2 Anwendung von malloc/free: Dynamische Felder char name[20]; strcpy(name, Helmke ); char* pname;... pname = malloc(sizeof(char)*20); strcpy(pname, Helmke ); strcpy(name, Leutheuser-Schnarrenberger ); // Das Verhalten ist hier undefiniert. free(pname); pname = malloc(sizeof(char)*50); strcpy(pname, Leutheuser-Schnarrenberger ); free(pname); V 4.02; Hon. Prof. Helmke 2

3 Anwendung von realloc/free: Dynamische Felder char* pname;... pname = malloc(sizeof(char)*20); Was halten Sie von dem Code? strcpy(pname, Helmke ); realloc(pname, sizeof(char)*50)); strcpy(pname, Leutheuser-Schnarrenberger ); free(pname); V 4.02; Hon. Prof. Helmke 3

4 Anwendung von realloc/free: Dynamische Felder char* pname;... pname = malloc(sizeof(char)*20); Das Folgende ist besser!!! strcpy(pname, Helmke ); pname = realloc(pname, sizeof(char)*50)); strcpy(pname, Leutheuser-Schnarrenberger ); free(pname); V 4.02; Hon. Prof. Helmke 4

5 strncpy The strncpy function copies the initial count characters of strsource to strdest and returns strdest. If count is less than or equal to the length of strsource, a null character is not appended automatically to the copied string. If count is greater than the length of strsource, the destination string is padded with null characters up to length count. The behavior of strncpy is undefined if the source and destination strings overlap. strncpy does not check for sufficient space in strdest; this makes it a potential cause of buffer overruns. The count argument limits the number of characters copied; it is not a limit on the size of strdest. V 4.02; Hon. Prof. Helmke 5

6 Etwas sicherer? void main() { char* pname; Ausgabe: pname = malloc(sizeof(char) * 20); size: 7 pname: Helmke size: 29 pname: Leutheuser - char shortname[] = "Helmke"; Schnarrenberger strncpy(pname, shortname, sizeof(shortname)); printf("size: %zd pname: %s\n", sizeof(shortname), pname); Was halten Sie von dem Code? pname = realloc(pname, sizeof(char) * 50); char longname[] = "Leutheuser - Schnarrenberger"; strncpy(pname, longname, sizeof(longname)); printf("size: %zd pname: %s\n", sizeof(longname), pname); } Nicht die Quelle, sondern das Ziel pname ist zu schützen V 4.02; Hon. Prof. Helmke 6

7 Etwas sicherer? void main() { char* pname; int heapsize = 20; pname = malloc(sizeof(char) * heapsize); char shortname[] = "Helmke"; strncpy(pname, shortname, heapsize); printf("size: %d pname: %s\n", heapsize, pname); Ausgabe: size: 20 pname: Helmke size: 50 pname: Leutheuser - Schnarrenberger heapsize = 50; pname = realloc(pname, heapsize); Was halten Sie von dem Code? char longname[] = "Leutheuser - Schnarrenberger"; strncpy(pname, longname, heapsize); printf("size: %d pname: %s\n", heapsize, pname); free(pname); } Wenn heapsize größer als pname und longname auch größer ist, kracht es! V 4.02; Hon. Prof. Helmke 7

8 Etwas sicherer? void main() { char* pname; int heapsize = 50; pname = malloc(sizeof(char) * 10); Programmverhalten undefiniert. char longname[] = "Leutheuser - Schnarrenberger"; strncpy(pname, longname, heapsize); printf("size: %d pname: %s\n", heapsize, pname); free(pname); } V 4.02; Hon. Prof. Helmke 8

9 Buffer Overflows / Overruns See A buffer overrun is one of the most common sources of security risk. A buffer overrun is essentially caused by treating unchecked, external input as trustworthy data. The act of copying this data, using operations such as CopyMemory, strcat, strcpy, or wcscpy, can create unanticipated results, which allows for system corruption. In the best of cases, your application will abort with a core dump, segmentation fault, or access violation. In the worst of cases, an attacker can exploit the buffer overrun by introducing and executing other malicious code in your process. Copying unchecked, input data into a stack-based buffer is the most common cause of exploitable faults. Buffer overruns can occur in a variety of ways. The following list provides a brief introduction to a few types of buffer overrun situations and offers some ideas and resources to help you avoid creating new risks and mitigate existing ones: V 4.02; Hon. Prof. Helmke 9

10 Buffer Overflows / Overruns See Static buffer overruns: A static buffer overrun occurs when a buffer, which has been declared on the stack, is written to with more data than it was allocated to hold. The less apparent versions of this error occur when unverified user input data is copied directly to a static variable, causing potential stack corruption. Heap overruns: Heap overruns, like static buffer overruns, can lead to memory and stack corruption. Because heap overruns occur in heap memory rather than on the stack, some people consider them to be less able to cause serious problems; nevertheless, heap overruns require real programming care and are just as able to allow system risks as static buffer overruns. Array indexing errors: Array indexing errors also are a source of memory overruns. Careful bounds checking and index management will help prevent this type of memory overrun. V 4.02; Hon. Prof. Helmke 10

11 Etwas sicherer void main() { char* pname; int heapsize = 50; pname = malloc(sizeof(char) * 10); char longname[] = "Leutheuser - Schnarrenberger"; strncpy(pname, longname, heapsize); printf("size: %d pname: %s\n", heapsize, pname); free(pname); } Programmverhalten undefiniert. void main() { char* pname; int heapsize = 50; pname = malloc(sizeof(char) * 10); char longname[] = "Leutheuser - Schnarrenberger"; // andere Parameter-Reihenfolge strcpy_s(pname, heapsize longname); printf("size: %d pname: %s\n", heapsize, pname); free(pname); } invalid parameter handler is invoked in strcpy_s. V 4.02; Hon. Prof. Helmke 11

12 Etwas sicherer in C++ durch Template int main() { char name[10]; char longname[] = "Leutheuser - Schnarrenberger"; // size not necessary in parameter list strcpy_s(name, longname); printf("size: pname: %s\n", name); } C++ Definiertes Programmverhalten: invalid parameter handler is invoked in strcpy_s. Die Größe von Quelle und Ziel bestimmt der Compiler. Leider geht es nur mit Strings (fester Größe) auf dem Stack!!! V 4.02; Hon. Prof. Helmke 12

13 strcpy_s (aus dem Standard, K ) Synopsis #include <string.h> errno_t strcpy_s(char * restrict s1, rsize_t s1max, const char * restrict s2); Runtime-constraints Neither s1 nor s2 shall be a null pointer. s1max shall not be greater than RSIZE_MAX. s1max shall not equal zero. s1max shall be greater than strnlen_s(s2, s1max). Copying shall not take place between objects that overlap. If there is a runtime-constraint violation, then if s1 is not a null pointer and s1max is greater than zero and not greater than RSIZE_MAX, then strcpy_s sets s1[0] to the null character. V 4.02; Hon. Prof. Helmke 13

14 strcpy_s (aus dem Standard, K ) (2) Description The strcpy_s function copies the string pointed to by s2 (including the terminating null character) into the array pointed to by s1. All elements following the terminating null character (if any) written by strcpy_s in the array of s1max characters pointed to by s1 take unspecified values when strcpy_s returns. Returns The strcpy_s function returns zero if there was no runtime-constraint violation. Otherwise, a nonzero value is returned. A zero return value implies that all of the requested characters from the string pointed to by s2 fit within the array pointed to by s1 and that the result in s1 is null terminated. V 4.02; Hon. Prof. Helmke 14

15 strncpy_s (aus dem Standard, K ) Synopsis #include <string.h> errno_t strncpy_s(char * restrict s1, rsize_t s1max, const char * restrict s2, rsize_t n); Runtime-constraints Neither s1 nor s2 shall be a null pointer. Neither s1max nor n shall be greater than RSIZE_MAX. s1max shall not equal zero. If n is not less than s1max, then s1max shall be greater than strnlen_s(s2, s1max). Copying shall not take place between objects that overlap. If there is a runtime-constraint violation, then if s1 is not a null pointer and s1max is greater than zero and not greater than RSIZE_MAX, then strncpy_s sets s1[0] to the null character.. V 4.02; Hon. Prof. Helmke 15

16 strncpy_s (aus dem Standard, K ) (2) Description: The strncpy_s function copies not more than n successive characters (characters that follow a null character are not copied) from the array pointed to by s2 to the array pointed to by s1. If no null character was copied from s2, then s1[n] is set to a null character. All elements following the terminating null character (if any) written by strncpy_s in the array of s1max characters pointed to by s1 take unspecified values when strncpy_s returns Returns The strncpy_s function returns zero if there was no runtime-constraint violation. Otherwise, a nonzero value is returned.. V 4.02; Hon. Prof. Helmke 16

17 strcpy_s, strncpy_s (Example) #include <string.h> char src1[100] = "hello"; char src2[7] = {'g', 'o', 'o', 'd', 'b', 'y', 'e'}; char dst1[6], dst2[5], dst3[5]; int r1, r2, r3; r1 = strncpy_s(dst1, 6, src1, 100); r2 = strncpy_s(dst2, 5, src2, 7); r3 = strncpy_s(dst3, 5, src2, 4); The first call will assign to r1 the value zero and to dst1 the sequence hello\0. The second call will assign to r2 a nonzero value and to dst2 the sequence \0. The third call will assign to r3 the value zero and to dst3 the sequence good\0. V 4.02; Hon. Prof. Helmke 17

18 Parameterfehler abfangen #include <stdio.h> /* wg. printf */ #include <stdlib.h> /* malloc*/ #include <string.h> #include <crtdbg.h> // For _CrtSetReportMode void myinvalidparameterhandler( const wchar_t* expression, const wchar_t* function, const wchar_t* file, Error-Handler setzen. unsigned int line, uintptr_t preserved) { wprintf(l"invalid parameter detected in function %s." L" File: %s Line: %d\n", function, file, line); wprintf(l"expression: %s\n", expression); } V 4.02; Hon. Prof. Helmke 18

19 Fehler abfangen (2) void main() { // Lösung unter Windows _set_invalid_parameter_handler( myinvalidparameterhandler); char* pname; int heapsize = 10; pname = malloc(sizeof(char) * 10); char longname[] = "Leutheuser - Schnarrenberger"; if (0== strcpy_s(pname, heapsize, longname)) { printf("size: %d pname: %s\n", heapsize, pname); } else { printf("da ging gewaltig was schief!!!\n"); } // geht gut da in strcpy_s hier // \0 geschrieben wird. free(pname); } invalid parameter handler is invoked in strcpy_s. V 4.02; Hon. Prof. Helmke 19

20 Fehler abfangen (3) void main() { // Lösung unter Windows _set_invalid_parameter_handler( myinvalidparameterhandler); char* pname; int heapsize = 10; pname = malloc(sizeof(char) * 10); char longname[] = "Leutheuser - Schnarrenberger"; V 4.02; Hon. Prof. Helmke 20

21 Fehler abfangen (4) void main() { // Lösung unter Windows _set_invalid_parameter_handler( myinvalidparameterhandler); char* pname; int heapsize = 10; pname = malloc(sizeof(char) * 10); char longname[] = "Leutheuser - Schnarrenberger"; Ausgabe: Invalid parameter detected in function common_tcscpy_s. File: minkernel\crts\ucr t\inc\corecrt_internal_string_templates. h Line: 81 Expression: (L"Buffer is too small" && 0) Da ging gewaltig was schief!!! _CrtSetReportMode( _CRT_ASSERT, 0); V 4.02; Hon. Prof. Helmke 21