Memory unsafety
Out-of-bounds write
Exercise 1.a: write C programs (new, different from those seen in lecture 01) that exhibit weakness CWE 787: Out-of-bounds write. Your goal is to make your program segfault due to this CWE! Try out-of-bound writes in various memory segments, writing one program for each of the following cases:
- out-of-bound write in dynamically allocated memory on the heap (e.g., with
malloc), - out-of-bound write in statically allocated memory (i.e., global variable, preinitialized or not),
- out-of-bound write in automatic memory (i.e., variables allocated on the stack).
Bonus point: make sure your programs do not emit any warnings when compiled invoking the compiler with the --Wall flag (which asks to enable all compile-time warnings and that you should always use anyway!).
Try to determine experimentally what each program was doing just before the segfault (tip: try with gdb, nm, ltrace, strace).
What helped you determine this?
Exercise 1.b: consider the following local variable declarations at the beginning of a function (possibly main):
char s1[16];
char s2[16];
write a program that does not segfault, but that with a single memory (or string) copy operation that writes to only one of these variables (s1, s2) modifies the content of both variables, with data of your choice.
Verify the result experimentally (e.g., with printf or strcmp).
Warning: do not forget about string \0 terminators!
Out-of-bounds read
Exercise 1.c: continuing from the idea from the previous exercise, write a program that exhibits at least one variant of CWE 125: Out-of-bounds read. The program should not segfault, but by performing a memory ready operation on a given variable, it should be able to read the content of another variable, correctly and in full.
Bonus point: make your program read the content of an out-of-scope local variable, e.g., one declared in a calling function.