Comments on: How not to fix buffer overflows

By: evan (LJ)

evan (LJ) — Tue, 17 Jul 2007 21:40:57 +0000

There is no “rethink”, there is only “run screaming in terror”. Seriously, it’s known Bad Software.

By: Jens Alfke

Jens Alfke — Tue, 17 Jul 2007 05:25:51 +0000

With gcc you need to explicitly enable the signed-unsigned-assignment warning … and I wouldn’t be surprised if PHP spews out tons of warnings as it builds (too much code I’ve seen does. I always build with warnings=errors.)

By: fluffy

fluffy — Tue, 17 Jul 2007 04:51:31 +0000

That reminds me of one time when I was a judge at the local ACM programming contest. One of the questions was to write a program to compute the Nth Fibonacci number - with the twist that N could be pretty large (so F(n) would have been greater than MAX_LONG). One of the teams of course did a naive implementation and when they found they had overflow problems, they switched to using longs - but that still wasn’t enough for some of the test cases, so they switched to doubles. When that failed to work they complained about how our compilers were “broken” and refused to accept that they didn’t get that problem right.

Finally during the awards ceremony (when they staged a little protest) one of the other judges and I explained the difference between magnitude and precision and they were sufficiently shamed/embarrassed.

The fact that PHP makes the same CS101 mistake, however… holy fucking ugh.

By: rpkrajewski (LJ)

rpkrajewski (LJ) — Tue, 17 Jul 2007 03:38:52 +0000

I saw the link in your del.icio.us link, and was aghast. For once my smug prejudices were roundly confirmed.

One thing puzzles me, though. calloc’s parameters are size_t’s, not int’s. The size_t type by its nature is unsigned. A strict compiler should warn about trying to fit a signed quantity in the space of the unsigned one when the bit widths of both are the same. (Conversions like unsigned char to signed int are perfectly OK, though; signed to unsigned conversions are never safe.) Even if PHP does not have unsigned int types at the interpreter level, it would seem like you would want to sanitize the integer parameters higher up in the “chunk” routine (i.e., where negative nunbers are already nonsense). At low levels, you could sanity check memory allocations checking against SIZE_MAX (Google around for it).

[Please delete my first empty comment.]

By: rpkrajewski (LJ)

rpkrajewski (LJ) — Tue, 17 Jul 2007 03:23:13 +0000