What are security issues in the C language?

-
What are security issues in the C language?


I recently read about two of them:

1.  Buffer Overflow:  It happens when data written to a buffer (chunk of memory) overflows and gets overwritten onto the adjacent memory due to lack of proper boundary checks. Let me show you something - consider the following code that I tried on Compile and Execute C Online, (An Online C Compiler):








You can clearly see that I have allocated memory for only 8 integers in the array 'a', but I have tried to access and modify the value corresponding to 10th integer in array 'a' (a memory location that belongs to some other entity). Certainly, anything this unethical must not be allowed, right guys... but the output is quite surprising, isn't it:

Then, I got a little more ambitious and tried the following:







and I got the utmost feared segmentation fault:



So, what happened ?

Well, C will allow a program to modify a memory as long as it belongs to the same program. In case of a[9] , the memory location belonged to the program, but in case of a[10000] it did not. 
(Note that even though the memory location a[9] belonged to the program and could be modified, it was not a good practice to do so, because it simply means that you are corrupting some other information stored by the program.)

2. Double Free Call: As the name suggests, it occurs when you try to free the memory allocated to a pointer, that has already been freed. Let us see something cool:


(Above code was compiled and executed on Compile and Execute C Online, (An Online C Compiler))

So, what's the problem, seems pretty fine to me ?

The problem, my dear folks, is that once you have freed the pointer 'a', you don't know if its new value is 'NULL' or does it point to some other location. If it does point to some other location, which it may, then it can also free that memory. 

I, then, tried to see, if a freed pointer is always automatically set to 'NULL', but it seems like not:








But fear not folks, for the whole of this world is not filled with darkness, and there is still some hope. The code where I tried to free the same pointer twice without reassignment did throw me an error with the message -"double free or corruption".  Phew !....., looks like this one has been taken care of.

(p.s: I would like to know about more vulnerabilities in C, it would be great if others could share them here.)

-----

Edit: After a comment , I decide that I must add to my answer that the second error (double free call) can actually be avoided by resetting the once freed pointer to NULL. For e.g. see below:




and the output:


(Above code was compiled and executed on Compile and Execute C Online, (An Online C Compiler

Thank you so much for reading this blog....

Ritchie shiva

Comments

Post a Comment

Popular posts from this blog

Cloud Computing?

-
Image
                What is Cloud Computing?       Learn the basic of cloud computing terminology and its uses. Simply, cloud computing is the delivery of computing services - Softwares, servers, storage, databases, networking, analytics and more -- over the internet ("The cloud"). Companies offering these computing services are called providers and typically charge for cloud computing services based on usage, similar to how you are billed for water or electricity at home. Still foggy on how cloud computing works and what it is for? This blog is designed to demonstrate the basic cloud computing jargon and concepts and quickly bring you up to speed. Use of cloud computing you are probably using cloud computing right now, even if don't realize it. If you use online service to send email, edit documents, watch movies or TV, listen to music, play games or store picture and other files, it is likely that cloud computing i...
Read more
-
Image
Robotics? Five factors supporting the rapid growth of robotics through 2022 The robotics industry growth has been tremendously high in the recent years. But the next few years are going to buzz with stupendous advancements in the robotic technology. With technological advancements, the robotics industry growth has gone up tremendously. Earlier, the interaction between a machine and a human was boring and limited. But, recent trends have it that a world full of robots can be a lot of fun. Today, robots can verbally interact, lend a helping hand, and also save lives, which probably makes robots more human-like with every passing day. Realizing the potential of robotics, many organizations have taken significant steps to bring robotics into application in diverse and unique fields. For instance, MIT has introduced the world to a soft robotic fish called SoFi to help save the ocean, whereas NASA is all set to send a  swarm of robots to Mars , similar to a swarm of bee...
Read more

C And C++ Programming Languages — Biggest Differences

-
Image
C And C++ Programming Languages — Biggest Differences And Comparison April 14, 2016 Short Bytes:  C vs C++ — which one is better? What is a procedural programming language and what is a modular programming language? Which one should be used for better and faster output? Well, we answer all the aspects of using C vs C++ against each other in this article. C Programming language is said to be the mother of most of the most famous languages. However, the next generations and child languages took over C very easily. Among all the programming languages, C is the most talked language against all. Let’s take a deeper look into the same and know why and how these languages are different. C vs C++: Comparison and differences Structural or procedural C is a structural or procedural programming language whereas C++ is a modular or an object-oriented programming language. Let’s look at it this way: Let’s imagine, you are building up a house in...
Read more