SECURE PROGRAMMING A.A. 2018/2019
INTEGER SECURITY System, Social and Mobile Security
SECURITY FLAWS The integers are formed by the natural numbers including 0 (0, 1, 2, 3, . . .) together with the negatives of the nonzero natural numbers (–1, –2, –3, . . .). Integers represent a growing and underestimated source of vulnerabilities in C programs, primarily because boundary. When developing secure systems, we cannot assume that a program will operate normally, given a range of expected inputs, because attackers are looking for input values that produce an abnormal effect. System, Social and Mobile Security
REPRESENTATION So, how are integer represented in C? Sign magnitude or two’s complement? System, Social and Mobile Security
TWO’S COMPLEMENT Binary value Two's complement Unsigned 00000000 0 0 00000001 1 1 ⋮ ⋮ ⋮ 01111110 126 126 01111111 127 127 10000000 −128 128 10000001 −127 129 10000010 −126 130 ⋮ ⋮ ⋮ 11111110 −2 254 11111111 −1 255 In two's-complement, there is only one zero, represented as 00000000. Negating a number (whether negative or positive) is done by inverting all the bits and then adding one to that result System, Social and Mobile Security
HOW TO GET THE COMPLEMENTARY From a number to its complement: from 5 to -5 Flip all the bits and then + 1 0000 0101 (value 5) ü 1111 1010 (flip) ü 1111 1011 (+1) You can do the inverse algorithm: when an integer number starts with 1 it means that it is negative ü 1111 1011 value (-5) ü 1111 1010 (-1) ü 0000 0101 (flip) System, Social and Mobile Security
HOW MANY NUMBERS CAN I REPRESENT? With n bits ü From (-2 N −1 ) to (2 N −1 − 1) ü There is no “-0”, so it is possible to represent one more negative number For instance, with 8 bits, ü from -128 to + 127 1000 0000 0111 1111 The rule in the previous slide to get the complimentary does not work because 128 is not representable with 8 bits in two’s complement System, Social and Mobile Security
OPERATION EXAMPLES Ok! 11111 111 (carry) 0000 1111 (15) 0000 1111 (15) + 1111 1011 ( − 5) + 1111 1011 ( − 5) ================== 0000 1010 (10) Arithmetic overflow! 0111 (carry) 0111 (7) 0111 (7) + 0011 (3) + 0011 (3) ============= 1010 ( − 6) invalid! Ok! 11110 000 (borrow) 0000 1111 (15) 0000 1111 (15) − 1111 1011 ( − 5) − 1111 1011 ( − 5) =========== 0001 0100 (20) System, Social and Mobile Security
UNSIGNED TYPES System, Social and Mobile Security
WRAPAROUND A computation involving unsigned operands can never overflow, because a result that cannot be represented by the resulting unsigned integer type is reduced modulo the number that is 1 greater than the largest value that can be represented by the resulting type. System, Social and Mobile Security
EXAMPLE System, Social and Mobile Security
EXAMPLE for (unsigned i = n; --i >= 0; ) // will never terminate This type of software failure occurred on Saturday, December 25, 2004, when Comair halted all operations and grounded 1,100 flights after a crash of its flight-crew- scheduling software. The software failure was the result of a 16-bit counter that limits the number of changes to 32,768 in any given month. Storms earlier in the month caused many crew reassignments, and the 16-bit value was exceeded. System, Social and Mobile Security
CHECKS System, Social and Mobile Security
CHECKS System, Social and Mobile Security
OPERATORS AND WRAPS System, Social and Mobile Security
SIGNED TYPES System, Social and Mobile Security
SIGNED TYPES In C, each unsigned integer type, excluding the type _Bool, has a corresponding signed integer type that occupies the same amount of storage. ü signed char ü short int ü int ü long int ü long long int System, Social and Mobile Security
WHY SO MANY SIGNED TYPES? Most integer variables are used as sizes, counters, or indices that require only nonnegative values. So why not declare them as unsigned integers that have a greater range of positive values? One possible explanation is the lack of an exception- handling mechanism in C. As a result, C programmers have developed various mechanisms for returning status from functions. System, Social and Mobile Security
WRAP WHEEL Two’s complement System, Social and Mobile Security
FROM GREATEST TO LOWEST System, Social and Mobile Security
EXAMPLES System, Social and Mobile Security
TABLE OF OPERATORS System, Social and Mobile Security
SIGNED AND UNSIGNED CHAR The CERT C Secure Coding Standard, “ INT07-C. Use only explicitly signed or unsigned char type for numeric values ” ü It is the only portable way to guarantee the signedness of the character types. System, Social and Mobile Security
TYPE CONVERSIONS System, Social and Mobile Security
HIERARCHY OF TYPES When arithmetic operands have different types, the implicit type conversion is governed by the types’ conversion rank. ü Any two unsigned integer types have different conversion ranks. If one is wider than the other, then it has a higher rank. ü Each signed integer type has the same rank as the corresponding unsigned type. ü The standard integer types are ranked in the order: • _Bool < char < short < int < long < long long ü The floating-point types are ranked in the following order: • float < double < long double ü The lowest-ranked floating-point type, float , has a higher rank than any integer type. ü Enum have the same rank as int. System, Social and Mobile Security
INTEGER PROMOTION In any expression, you can always use a value whose type ranks lower than int in place of an operand of type int or unsigned int . In these cases, the compiler applies integer promotion : any operand whose type ranks lower than int is automatically converted to the type int , provided int is capable of representing all values of the operand’s original type. If int is not sufficient, the operand is converted to unsigned int . Operations in the CPU are executed on 4 bytes at least System, Social and Mobile Security
EXAMPLE 120 #include <stdio.h> int main() { char a = 30, b = 40, c = 10; char d = (a * b) / c; printf ("%d ", d); return 0; } At first look, the expression (a*b)/c seems to cause arithmetic overflow because signed characters can have values only from -128 to 127 (in most of the C compilers), and the value of subexpression ‘(a*b)’ is 1200 which is greater than 128. But integer promotion happens here in arithmetic done on char types and we get the appropriate result without any overflow. System, Social and Mobile Security
WHAT DOES IT HAPPEN? The usual arithmetic conversions are applied as follows: ü If either operand has a floating-point type, then the operand with the lower conversion rank is converted to a type with the same rank as the other operand. Real types are converted only to real types. ü If both operands are integers, integer promotion is first performed on both operands. If after integer promotion the operands still have different types, conversion continues as follows: • If one operand has an unsigned type T whose conversion rank is at least as high as that of the other operand’s type, then the other operand is converted to type T . • Otherwise, one operand has a signed type T whose conversion rank is higher than that of the other operand’s type. The other operand is converted to type T only if type T is capable of representing all values of its previous type. If not, then both operands are converted to the unsigned type that corresponds to the signed type T . System, Social and Mobile Security
EXAMPLES int x = 0; int i = -1; unsigned int limit = 200U; long n = 30L; if ( i < limit ) x = limit * n; printf(“%d\n”, x); 0 In this example, to evaluate the comparison in the if condition, the value of i, –1, must first be converted to the type unsigned int . The result is a large positive number (next slide). Hence, the if condition is false . In the if, the value of limit is converted to n ’s type, long , if the value range of long contains the whole value range of unsigned int . If not— for example, if both int and long are 32 bits wide—then both multiplicands are converted to unsigned long . System, Social and Mobile Security
CONVERSIONS TO UNSIGNED INTEGER TYPES Integer values are always preserved if they are within the range of the new unsigned type ü Between 0 and U type _MAX For values outside the new unsigned type’s range, the value after conversion is the value obtained by adding (U type _MAX + 1) as many times as necessary until the result is within the range of the new type. unsigned short n = 1000; // The value 1000 is within the range of // unsigned short n = -1; // the value –1 must be converted. –1 + (USHRT_MAX + 1) = USHRT_MAX, the final statement in the previous example is equivalent to n = USHRT_MAX; System, Social and Mobile Security
INTEGER VULNERABILITIES System, Social and Mobile Security
EXAMPLE JPEG COM Marker Processing Vulnerability in Netscape Browsers size_t is always an alias for an unsigned type What if 1 is passed as length? System, Social and Mobile Security
CONVERSION ERRORS malloc() takes size_t as argument What if 1 negative? System, Social and Mobile Security
Recommend
More recommend
