Code Security

Is it possible to write code in C and not be vulnerable to buffer overflows? Or is this a fool's errand?

Yeah there are special functions to avoid them, where you can specify length.  For example, strncpy as opposed to strcpy.

It's actually pretty simple to write secure C code, if you take a few simple precautions.

1) Always use fixed size arrays, declared in global scope for main access.

2) Allow the user to use format specifiers in input strings, for as the saying goes, "%s %02X %.02f"

3) Never use the the functions >>2 described, they are dangerous.

>>3 Why's that?

>>4,
>>3 just told you exactly what NOT to do you fucking idiot.

OFCOURSE IT'S FUCKING POSSIBLE TO WRITE C CODE WITHOUT BoF's if it was not , no one would use C for fucks sake.

Here's a small example avoiding buffer overflows

char buffer[100]; // 100 bytes storage here
fgets(buffer, 100, stdin); // no buffer overflows

Here's a buffer overflow
char buffer[10000]; // 10.000 bytes storage here
scanf("%s", buffer); // here's the BoF part..
Let's compile and exploit the second one..


[anonymous@post ~]$ gcc bof.c -o bof
[anonymous@post ~]$ ./bof `perl -e 'print "A"x10001'`

simple.

>>5

Let's see some root shells then, faggot

>>6
...

>>1
bampu pantsu

neither C or C++ were designed to be secure languages (the languages provide no boundary checking or other safeguards and have very lax typing), to write secure code you have to follow special rules and guidelines and only use secure subsets such as MISRA C or JSF++

The D Programming Language was designed to be secure yet powerful as C and C++.

>>9
Bullshit. That's something only a true Java lunatic would say.

>>11
Spoiler: You got that one right!!!

>>11
I dont even get that, you think MISRA C is a myth created by Java fanatics?

>>13
No. MISRA C is a completely redundant language created by people who don't know what a system language is.

Which are usually Java folks (big fucking surprise).

MISRA C is a just a set of guidelines that tries to minimize the damage done by mediocre C programmers.

>>14
A systems programming language is usually a language that gives the programmer full control and does not confine the programmer to any rules. The operating system that controls the computer you use is not a critical system, if it crashes, you just reboot it, no one gets killed. Reliable code is just a selling point to operating systems. The people who developed MISRA C program the electronics that controls the brakes in your car, where there is zero tolerance for error.

>>15
MISRA C is a C subset that throws out all parts of C that can not be made secure, such as I/O functions that use pointers, exceptions and other things as well as setting up guidelines for secure code.

>>16
MISRA C is a C subset that throws out all parts of C that can not be made secure
MISRA C is a C subset that throws out all parts of C.

>>16,17
such as I/O functions that use pointers, exceptions

PDF slides explaining the reasoning behind JSF++
http://www.ldra.com/nologindownload.asp?id=134

>>16-18
C
secure code

[quote]
a
b
c
[/quote]
[q]
a
b
c
[/q]
test

Bringing /prog/ back to its people
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy
All work and no play makes Jack a dull boy