常见软件安全漏洞样例代码

Example1.1：
...
char buf[BUFSIZE];
gets(buf);//user control
...

Example1.2(c++):
...
char buf[BUFSIZE];
cin >> (buf);//user control
...

Example2:
...
char buf[64], in[MAX_SIZE];
printf("Enter buffer contents:\n");
read(0, in, MAX_SIZE-1);
printf("Bytes to copy:\n");
scanf("%d", &bytes);//user control
memcpy(buf, in, bytes);
...
char *lccopy(const char *str) {
char buf[BUFSIZE];
char *p;

strcpy(buf, str);
for (p = buf; *p; p++) {
if (isupper(*p)) {
*p = tolower(*p);
}
}
return strdup(buf);
}

Example4:
if (!(png_ptr->mode & PNG_HAVE_PLTE)) {
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Missing PLTE before tRNS");
}
else if (length > (png_uint_32)png_ptr->num_palette) {
png_warning(png_ptr, "Incorrect tRNS chunk length");
png_crc_finish(png_ptr, length);
return;
}
...
png_crc_read(png_ptr, readbuf, (png_size_t)length);

Example5:
void getUserInfo(char *username, struct _USER_INFO_2 info){
WCHAR unicodeUser[UNLEN+1];
MultiByteToWideChar(CP_ACP, 0, username, -1,
unicodeUser, sizeof(unicodeUser));
NetUserGetInfo(NULL, unicodeUser, 2, (LPBYTE *)&info);
}

Example1:
int main(int argc, char **argv){
char buf[128];
...
snprintf(buf,128,argv[1]);
}

Example2:
printf("%d %d %1$d %1$d\n", 5, 9);

Example3:
...
syslog(LOG_ERR, cmdBuf);
...

Example4:
#include <stdio.h>

void printWrapper(char *string) {
printf(string);
}

int main(int argc, char **argv) {
char buf[5012];
memcpy(buf, argv[1], 5012);
printWrapper(argv[1]);
return (0);
}

Example1:
short int bytesRec = 0;
char buf[SOMEBIGNUM];

while(bytesRec < MAXGET) {
bytesRec += getFromInput(buf+bytesRec);
}

Example2:
nresp = packet_get_int();
if (nresp > 0) {
response = xmalloc(nresp*sizeof(char*));
for (i = 0; i < nresp; i++)
response[i] = packet_get_string(NULL);
}

Example3:
char* processNext(char* strm) {
char buf[512];
short len = *(short*) strm;
strm += sizeof(len);
if (len <= 512) {
memcpy(buf, strm, len);
process(buf);
return strm + len;
} else {
return -1;
}
}

Example4:
rezos@bezel ~/labs/integer $ cat add.c
#include <stdio.h>
#include <limits.h>

int main(void)
{
int a;

//  a=2147483647;
a=INT_MAX;

printf("int a (INT_MAX) = %d (0x%x), int a (INT_MAX) + 1 = %d (0x%x)\n", a,a,a+1,a+1);

return 0;
}

rezos@bezel ~/labs/integer $ ./add
int a (INT_MAX) = 2147483647 (0x7fffffff), int a (INT_MAX) + 1 = -2147483648 (0x80000000)

Example5:
rezos@bezel ~/labs/integer $ cat multiplication.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main(int argc, char **argv)
{
int i, j, z=0x00000001;
char *tab;

if(argc<2) _exit(1);

i=atoi(argv[1]);

if(i>0) {
tab = malloc(i * sizeof(char *));
if(tab == NULL) _exit(2);
}

for(j=0; j<i; j++)
tab[j]=z++;

for(j=0; j<i; j++)
printf("tab[j]=0x%x\n", tab[j]);

return 0;
}

rezos@bezel ~/labs/integer $ ./multiplication 1073741824
Segmentation fault