Exercise 101: Will This While Loop Terminate? If Yes, After

Exercise 101 Will This While Loop Terminate If Yes After How Many I

Exercise 10.1 Will this while loop terminate? If yes, after how many iterations? Does the result change if the variables are unsigned integers instead of signed integers? int i = 1; int c = 1; while (i > 0) { i = i * 2; c++; }

Business software stores dates in the binary-coded decimal (BCD) format. Decimal digits are encoded in four bits by their binary representation. A byte stores two decimal digits. For which days of the month, for which months of the year, and for which years is the binary value stored in a byte different from its BCD value?

Exercise 10.3 Give a fix for the flaw in the code for concatenating two strings discussed in Section 10.2.3.

Exercise 10.4 An alternative design for a canary mechanism places the NULL value just below the return address. What is the rationale for this design decision? When does this method meet its objectives, and what are its limitations?

Exercise 10.5 What is the flaw in the code snippet below that fills a buffer with zeros? How can the problem be fixed? char* buf; buf = malloc(BUFSIZ); memset ( buf, 0, BUFSIZ );

Exercise 10.6 You are given chunks whose length is a multiple of 16 bytes. For each size of chunk, there is a separate bin. The following instruction takes the size of a chunk in bytes and calculates the index of the bin the chunk belongs to: #define bin_index(size) ( ( ( (unsigned int)(size) ) >> 3) - 2) Why is this instruction vulnerable to a buffer overrun attack?

Exercise 10.7 Unix systems use environment variables to configure the behaviour of utility programs. A program executing another program can set the environment variables for that program. How could this fact be used in an attack? What defences should programmers apply?

Exercise 10.8 Consider a memory system that stores free blocks in a double-linked list IDX in ascending order of size. A free block P of size S is inserted using the frontlink command given below. Blocks are taken from the list using unlink. How does this system react when a block that is already in the free list is added again, and removed later? #define frontlink(A, P, S, IDX, BK, FD) ... [1] FD = start_of_bin(IDX); [2] while ( FD != BK && S fd; } [4] BK = FD->bk; [5] P->bk = BK; [6] P->fd = FD; [7] FD->bk = BK->fd = P; }

Exercise 10.9 Analyze how frontlink could be exploited in a memory corruption attack.

Exercise 10.10 Design a scalable protection mechanism for chunks that uses canaries without having to store reference values for all canaries.

Exercise 10.11 You are given an archiving function that writes to a zip archive storing files with their directory path. Extraction from the archive restores files at the location given. How could an attacker working in user mode who has no access to the root directory or to /etc, and who is not permitted to archive /etc/passwd, overwrite this file?

Exercise 10.12 Define test cases for frontlink and unlink.

Exercise 10.13 Determine the sanitization functions and trust sinks in a taint analysis of PHP scripts that addresses cross-site scripting attacks (Section 18.4).

Exercise 10.14 It has been claimed that full disclosure of software vulnerabilities will improve software security. When a vulnerability is found, what steps have to be taken so that the problem is eventually fixed at the end user’s site? Give a step-by-step analysis discussing important issues that should be taken into account. What are the advantages and/or disadvantages of full disclosure?

Paper For Above instruction

The provided exercises cover a broad range of topics in software security, programming, and system design. This paper will analyze the key concepts, challenges, and solutions associated with each exercise, emphasizing the importance of security mechanisms, proper programming practices, and vulnerability mitigation strategies.

Analysis of the While Loop Termination (Exercise 10.1)

The question centers on whether the while loop will terminate. Given the code:

int i = 1;


int c = 1;


while (i > 0) {


i = i * 2;


c++;


}

In the case of signed integers, doubling 'i' repeatedly leads to overflow once 'i' exceeds the maximum value representable (typically 2,147,483,647 for 32-bit signed int), which causes 'i' to become negative or wrap around due to overflow rules. This results in the loop terminating after a finite number of iterations, approximately 31 times, before overflow causes 'i' to become negative or zero, terminating the loop.

However, if 'i' is an unsigned integer, overflow behavior is well-defined in C, wrapping around modulo 2^n. Doubling 'i' still results in wrapping around after about 32 iterations (for a 32-bit unsigned integer), ultimately leading 'i' back to zero or a small value. Therefore, the loop terminates after about 31 to 32 iterations regardless of signedness, but the specific behavior can differ, affecting whether the loop terminates or runs indefinitely.

BCD Storage and Day/Month/Year Representation

Business software often uses Binary-Coded Decimal (BCD) format for dates, where each nibble (4 bits) encodes a decimal digit. Since a byte contains two BCD digits, the encoding for days (1–31), months (1–12), and years (depending on the range) can differ from pure binary representations:

  • Days 1–9 are encoded with the lower nibble containing the digit, and the higher nibble zero or part of the next digit.
  • Days 10–31 have higher nibbles representing '1' or '2' in tens digit, with units digit in the lower nibble.
  • Similarly, months 10–12 also differ from pure binary, as their BCD encoding will differ from standard binary values.
  • Years often encoded similarly, but the specific range impacts whether BCD and binary values differ; for example, 1999 (0x19 in BCD) differs from binary 0x199.

Thus, stored BCD values differ from their binary equivalents primarily for numbers greater than 9, which encompass most days, months, and a range of years.

Fix for String Concatenation Flaw (Exercise 10.3)

A typical flaw in string concatenation code relates to buffer overflows or improper null-termination. The fix involves ensuring sufficient buffer space and correctly null-terminating the resulting string. For example, if concatenating two strings:

char buf[BUFFERSIZE];


strcpy(buf, str1);


strcat(buf, str2);

To fix potential overflow, dynamically allocate enough memory or use safer functions like 'strncat' with size limits, and ensure the buffer is null-terminated after concatenation.

Canary Mechanism and NULL Placement (Exercise 10.4)

Placing a NULL byte just below the return address in a canary mechanism serves as an immediate indicator of buffer overflow detection. The rationale is that overwriting the buffer beyond its boundary would likely overwrite the NULL value, signaling tampering.

This method meets its objectives when buffer overflows attempt to overwrite control data, but limitations include the possibility of bypassing if an attacker knows the exact placement or if not implemented tightly, which can reduce detection efficacy.

Buffer Filling with memset (Exercise 10.5)

The flaw in the code snippet:

char* buf;


buf = malloc(BUFSIZ);


memset(buf, 0, BUFSIZ);

may appear if 'malloc' fails, returning NULL, leading to 'memset' being called with a NULL pointer, causing undefined behavior or segmentation faults. Fixes include checking the result of 'malloc' before calling 'memset'.

Buffer Overrun Vulnerability in Chunk Size Calculation (Exercise 10.6)

The macro:

define bin_index(size) ( ((unsigned int)(size) >> 3) - 2)

is vulnerable because if 'size' is very small (less than 16), the calculation yields a negative number after subtraction, which, due to unsigned integer conversion, wraps around to a large value, potentially indexing outside valid bins. An attacker can exploit this shift to cause buffer overruns, especially if boundary checks are omitted.

Environment Variables as Attack Vector (Exercise 10.7)

Because Unix programs inherit environment variables, an attacker can manipulate environment variables to influence child process behavior, potentially injecting malicious configurations or commands. Defences include validating environment variables, restricting environment variable inheritance, and employing secure coding practices to ignore untrusted variables.

Memory System with Double-Linked List and Re-insertion (Exercise 10.8)

Re-inserting an already free block 'P' can corrupt the free list. The 'frontlink' macro may create a circular list or duplicate entries, leading to undefined behavior during later unlinks or allocations. Proper checks to avoid double insertion are necessary to maintain list consistency and integrity.

Exploitation of frontlink in Memory Corruption (Exercise 10.9)

The 'frontlink' macro could be exploited if an attacker manipulates pointers or sizes to overwrite critical list pointers, enabling arbitrary memory writes. Carefully validating pointers and sizes before insertion is essential to prevent such exploits.

Protecting Chunks with Canaries (Exercise 10.10)

Designing a scalable canary protection mechanism without storing individual reference values involves using cryptographic or deterministic canaries derived from a secret key or system state, verifying the integrity before deallocation. Techniques include using a global secret or hash-based canaries that can be recalculated and verified efficiently.

Overwriting Files via Zip Archives (Exercise 10.11)

An attacker could exploit path traversal vulnerabilities in archive extraction, where malicious archive entries specify paths that overwrite protected files like '/etc/passwd'. Defenses include sanitizing paths, canonicalizing filenames, and enforcing strict extraction policies that prevent overwriting critical system files.

Test Cases for frontlink and unlink (Exercise 10.12)

Test cases should include inserting null or invalid pointers, inserting blocks of different sizes, and attempting double insertions or deletions to ensure list integrity. Boundary tests and concurrent modifications should also be considered.

Sanitization and Trust Sinks in PHP (Exercise 10.13)

Sanitization functions include filtering functions like 'htmlspecialchars' and 'filter_var', which sanitize user input. Trust sinks are points where data is emitted to the user, such as 'echo' or 'print'. Proper sanitization at input points and safe output practices mitigate cross-site scripting (XSS) vulnerabilities.

Full Disclosure Strategy (Exercise 10.14)

When a vulnerability is found, steps include responsible disclosure, reporting to developers, coordination for patch development, testing, and gradual deployment through updates. Advantages of full disclosure include transparency and faster patching, but risks involve exposing attackers before fixes are deployed. Careful management balances these factors.

Conclusion

The exercises underscore the critical importance of robust programming practices, proactive security mechanisms, and responsible vulnerability management to safeguard software systems. Addressing overflow vulnerabilities, implementing proper memory management techniques, sanitizing inputs, and managing disclosure processes are essential components of secure software development.

References

  • Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2009). Introduction to Algorithms. MIT press.
  • Grossman, J. (2007). Secure Programming Cookbook for C and C++. O'Reilly Media.
  • McGraw, G. (2006). Software security: Building security in. Addison-Wesley.
  • OWASP Foundation. (2023). OWASP Top Ten Web Application Security Risks. Retrieved from https://owasp.org
  • ISO/IEC. (2018). ISO/IEC 27001:2013: Information Security Management Systems.
  • ISO/IEC. (2012). ISO/IEC 15408:2005, Common Criteria for Information Technology Security Evaluation.
  • Schneider, F., & Moritz, G. (2014). Effective techniques for buffer overflow mitigation. Security Journal, 27(1), 77-94.
  • Al-Sabti, N., & Rehman, S. (2020). Addressing Path Traversal in Archive Extraction. Journal of Cybersecurity, 6(1), 56-65.
  • Ristic, I. (2017). Bulletproof SSL and TLS. Feisty Duck.
  • Chosein, C. (2019). Memory Safety and Vulnerability Mitigation Techniques. ACM Computing Surveys, 52(4), 72.

Related Assignments