常见软件安全漏洞样例代码

缓冲区溢出：

Example1.1：
        ...
    char buf[BUFSIZE]; 
    gets(buf);//user control
    ...

Example1.2(c++):
    ...
    char buf[BUFSIZE]; 
    cin >> (buf);//user control
    ...

Example2:
    ...
    char buf[64], in[MAX_SIZE];
    printf("Enter buffer contents:
");
    read(0, in, MAX_SIZE-1);
    printf("Bytes to copy:
");
    scanf("%d", &bytes);//user control
    memcpy(buf, in, bytes);
    ...
    char *lccopy(const char *str) {
        char buf[BUFSIZE];
        char *p;
    
        strcpy(buf, str);
        for (p = buf; *p; p++) {
             if (isupper(*p)) {
                *p = tolower(*p);
            }
        }    
        return strdup(buf);
    }

Example4:
    if (!(png_ptr->mode & PNG_HAVE_PLTE)) {
        /* Should be an error, but we can cope with it */
        png_warning(png_ptr, "Missing PLTE before tRNS");
    }
    else if (length > (png_uint_32)png_ptr->num_palette) {
        png_warning(png_ptr, "Incorrect tRNS chunk length");
        png_crc_finish(png_ptr, length);
        return;
    }
    ...
    png_crc_read(png_ptr, readbuf, (png_size_t)length);

Example5:
    void getUserInfo(char *username, struct _USER_INFO_2 info){
        WCHAR unicodeUser[UNLEN+1];
        MultiByteToWideChar(CP_ACP, 0, username, -1,
                            unicodeUser, sizeof(unicodeUser));
    NetUserGetInfo(NULL, unicodeUser, 2, (LPBYTE *)&info);
    }

格式化字符串：

Example1:
    int main(int argc, char **argv){
        char buf[128];
        ...
        snprintf(buf,128,argv[1]);
    }

Example2:
printf("%d %d %1$d %1$d
", 5, 9);

Example3:
    ...
    syslog(LOG_ERR, cmdBuf);
    ...

Example4:
#include <stdio.h>

void printWrapper(char *string) {   
  printf(string);
}

int main(int argc, char **argv) {   
  char buf[5012];    
  memcpy(buf, argv[1], 5012);    
  printWrapper(argv[1]);    
  return (0);
}

整数溢出：

Example1:
short int bytesRec = 0;
char buf[SOMEBIGNUM];

while(bytesRec < MAXGET) {
  bytesRec += getFromInput(buf+bytesRec);
}

Example2:
    nresp = packet_get_int();
    if (nresp > 0) {
     response = xmalloc(nresp*sizeof(char*));
     for (i = 0; i < nresp; i++)
      response[i] = packet_get_string(NULL);
    }

Example3:
     char* processNext(char* strm) {
     char buf[512];
     short len = *(short*) strm;
     strm += sizeof(len);
     if (len <= 512) {
      memcpy(buf, strm, len);
      process(buf);
      return strm + len;
     } else {
      return -1;
     }
    }

Example4:
rezos@bezel ~/labs/integer $ cat add.c
#include <stdio.h>
#include <limits.h>

int main(void)
{
 int a;

//  a=2147483647;
 a=INT_MAX;

 printf("int a (INT_MAX) = %d (0x%x), int a (INT_MAX) + 1 = %d (0x%x)
", a,a,a+1,a+1);

 return 0;
}

rezos@bezel ~/labs/integer $ ./add
int a (INT_MAX) = 2147483647 (0x7fffffff), int a (INT_MAX) + 1 = -2147483648 (0x80000000)

Example5:
rezos@bezel ~/labs/integer $ cat multiplication.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main(int argc, char **argv)
{
 int i, j, z=0x00000001;
 char *tab;

 if(argc<2) _exit(1);

 i=atoi(argv[1]);

 if(i>0) {
   tab = malloc(i * sizeof(char *));
   if(tab == NULL) _exit(2);
 }

 for(j=0; j<i; j++)
   tab[j]=z++;

 for(j=0; j<i; j++)
   printf("tab[j]=0x%x
", tab[j]);

 return 0;
}

rezos@bezel ~/labs/integer $ ./multiplication 1073741824
Segmentation fault