Reviewing Code for Buffer Overruns and Overflows - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:12:56Z

Added navigation to facilitate sequential reading online

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-06-03T12:49:58Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 02:20, 31 May 2009

2009-05-31T02:20:45Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-29T18:01:01Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 16:42, 29 May 2009

2009-05-29T16:42:14Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textrolliord.com

2009-05-27T18:28:47Z

Reverting to last version not containing links to www.textrolliord.com

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-27T16:00:43Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 12:10, 26 May 2009

2009-05-26T12:10:52Z

Deleted user at 20:13, 22 May 2009

2009-05-22T20:13:56Z

KirstenS: /* Crashing an application: */

2009-01-27T17:42:04Z

‎Crashing an application:

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ==The Buffer ==
@@ Line 159: / Line 164: @@
 ==.NET & Java ==
 C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environment’s own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
 [[Category:OWASP Code Review Project]]

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
@@ Line 84: / Line 39: @@
 ==Vulnerable Patterns for Buffer Overflows==
-===âVanillaâ buffer overflow: ===
+===‘Vanilla’ buffer overflow: ===
 Example: A program might want to keep track of the days of the week (7). The programmer tells the computer to store a space for 7 numbers. This is an example of a buffer. But what happens if an attempt to add 8 numbers is performed? Languages such as C and C++ do not perform bounds checking, and therefore if the program is written in such a language, the 8th piece of data would overwrite the program space of the next program in memory, and would result in data corruption. This can cause the program to crash at a minimum or a carefully crafted overflow can cause malicious code to be executed, as the overflow payload is actual code.
@@ Line 203: / Line 158: @@
 ==.NET & Java ==
-C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environmentâs own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
+C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environment’s own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
 [[Category:OWASP Code Review Project]]

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
@@ Line 39: / Line 84: @@
 ==Vulnerable Patterns for Buffer Overflows==
-===‘Vanilla’ buffer overflow: ===
+===âVanillaâ buffer overflow: ===
 Example: A program might want to keep track of the days of the week (7). The programmer tells the computer to store a space for 7 numbers. This is an example of a buffer. But what happens if an attempt to add 8 numbers is performed? Languages such as C and C++ do not perform bounds checking, and therefore if the program is written in such a language, the 8th piece of data would overwrite the program space of the next program in memory, and would result in data corruption. This can cause the program to crash at a minimum or a carefully crafted overflow can cause malicious code to be executed, as the overflow payload is actual code.
@@ Line 158: / Line 203: @@
 ==.NET & Java ==
-C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environment’s own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
+C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environmentâs own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
 [[Category:OWASP Code Review Project]]

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
@@ Line 40: / Line 39: @@
 ==Vulnerable Patterns for Buffer Overflows==
-===âVanillaâ buffer overflow: ===
+===‘Vanilla’ buffer overflow: ===
 Example: A program might want to keep track of the days of the week (7). The programmer tells the computer to store a space for 7 numbers. This is an example of a buffer. But what happens if an attempt to add 8 numbers is performed? Languages such as C and C++ do not perform bounds checking, and therefore if the program is written in such a language, the 8th piece of data would overwrite the program space of the next program in memory, and would result in data corruption. This can cause the program to crash at a minimum or a carefully crafted overflow can cause malicious code to be executed, as the overflow payload is actual code.
@@ Line 159: / Line 158: @@
 ==.NET & Java ==
-C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environmentâs own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
+C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environment’s own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
 [[Category:OWASP Code Review Project]]

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
@@ Line 39: / Line 40: @@
 ==Vulnerable Patterns for Buffer Overflows==
-===‘Vanilla’ buffer overflow: ===
+===âVanillaâ buffer overflow: ===
 Example: A program might want to keep track of the days of the week (7). The programmer tells the computer to store a space for 7 numbers. This is an example of a buffer. But what happens if an attempt to add 8 numbers is performed? Languages such as C and C++ do not perform bounds checking, and therefore if the program is written in such a language, the 8th piece of data would overwrite the program space of the next program in memory, and would result in data corruption. This can cause the program to crash at a minimum or a carefully crafted overflow can cause malicious code to be executed, as the overflow payload is actual code.
@@ Line 158: / Line 159: @@
 ==.NET & Java ==
-C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environment’s own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
+C# or C++ code in the .NET framework can be immune to buffer overflows if the code is managed. Managed code is code executed by a .NET virtual machine, such as Microsoft's. Before the code is run, the Intermediate Language is compiled into native code. The managed execution environmentâs own runtime-aware complier performs the compilation; therefore the managed execution environment can guarantee what the code is going to do. The Java development language also does not suffer from buffer overflows; as long as native methods or system calls are not invoked, buffer overflows are not an issue. Finally ASP pages are also immune to buffer overflows due to Integer Overflow checks performed by the VBScript interpreter while executing the code.
 [[Category:OWASP Code Review Project]]

@@ Line 80: / Line 80: @@
    printf (User_Input);
-If we supply %x (hex unsigned int) as the input, the '''printf''' function shall expect to find an integer relating to that format string, but no argument exists. This can not be detected at compile time. At runtime this issue shall surface.
+If we supply %x (hex unsigned int) as the input, the '''printf''' function shall expect to find an integer relating to that format string, but no argument exists. This cannot be detected at compile time. At runtime this issue shall surface.
 ===Walking the stack: ===