Subscribe To Our Feed | Follow Us On Twitter | Get Updates on Email
If you are writing a software which exposes APIs to be used by a third party, then first thing you have to do is to make sure that all the integers parameters have been validated. Every incoming value to your function should be considered as tainted. The function should validate the input value by checking it for all possible malicious value. After the function validates the input, then only any operation on the input value should be performed.
Consider the following code sample:
void func( int size )
{
char* str;
if(size > 0 )
{
str = (char*)malloc(size * sizeof(char*));
size++;
/**
*some code to operate on this string "str"
**/
free(str);
}
}I am sure that by now, you would have identified some loop holes in this code. Now, a caller of this function can give different input values which might result in following flaws:
1) The function might get an highest input value which results in a large memory allocation for ‘char* str’ which the function never expected.
2) The function might result in memory allocation failure as there is possiblity of the system running out of memory.
3) The function might have an overflow issue due to an increment in input value which could have been equal to SIZE_MAX.
These scenarios might serve as a boon for a hacker and he/she can instigate either a denial of service or any other buffer overflow errors.
Now, Lets rework the above depicted code again.
#define MAX_SIZE_OF_STRING ( 100 )
void func( int size )
{
char* str;
if(size > 0 && size <= MAX_SIZE_OF_STRING)
{
if(str == null)
{
str = (char*)malloc( size * sizeof(char*));
if(size < SIZE_MAX)
{
size++;
}
/**
*some code to operate on this string "str"
**/
}
if(str != null)
{
free(str);
}
}
}Please try to notice few defensive points from the above given code.
1) We have defined a maximum size for the string. We need to do this to make sure that large chunks of memory do not get allocated. This will result in optimized memory usage and longer life of the program.
2) We have validated the input value for its range comparing against its minimum and maximum value. By doing this, We sufficed the purpose of defining the size of the string.
3) Again, we check the input variable size for its value less than SIZE_MAX (maximum value possible for an integer). By doing this, we safeguarded against an overflow. Now, the size variable can never incremented beyond the maximum value.
4) Checking for ’size > 0′ helps in making sure that non zero number of bytes are allocated in memory, in turn, saving us from memory corruption.
By adding extra defense checks or safeguards, you might contribute towards addition in code size. But isn’t it better to have a secure code rather than less code which is vulnerable to exploits.
The point I am trying to make is very simple and is not a great deal. Everyone of us know of it but we tend to ignore these minor things resulting in misuse of code. Keeping these small points in mind while coding and adding these defense checks or safeguards will definitely result in robust and secure code.
© Safer Code | Validating Untrusted Integer Inputs
).