Memory unsafety
Out-of-bounds write
Exercise 1.a: write C programs (new, different from those seen in lecture 01) that exhibit weakness CWE 787: Out-of-bounds write. Your goal is to make your program segfault due to this CWE! Try out-of-bound writes in various memory segments, writing one program for each of the following cases:
- out-of-bound write in dynamically allocated memory on the heap (e.g., with
malloc
), - out-of-bound write in statically allocated memory (i.e., global variable, preinitialized or not),
- out-of-bound write in automatic memory (i.e., variables allocated on the stack).
Bonus point: make sure your programs do not emit any warnings when compiled invoking the compiler with the --Wall
flag (which asks to enable all compile-time warnings and that you should always use anyway!).
Try to determine experimentally what each program was doing just before the segfault (tip: try with gdb, nm, ltrace, strace).
What helped you determine this?
Exercise 1.b: consider the following local variable declarations at the beginning of a function (possibly main
):
char s1[16];
char s2[16];
write a program that does not segfault, but that with a single memory (or string) copy operation that writes to only one of these variables (s1
, s2
) modifies the content of both variables, with data of your choice.
Verify the result experimentally (e.g., with printf
or strcmp
).
Warning: do not forget about string \0
terminators!
Out-of-bounds read
Exercise 1.c: continuing from the idea from the previous exercise, write a program that exhibits at least one variant of CWE 125: Out-of-bounds read. The program should not segfault, but by performing a memory ready operation on a given variable, it should be able to read the content of another variable, correctly and in full.
Bonus point: make your program read the content of an out-of-scope local variable, e.g., one declared in a calling function.