Re: ANSI C and POSIX (was Re: C/C++ knocks the crap out of Ada)

[c2a192@ugrad.cs.ubc.ca (Kazimir Kylheku)]

In article <EACHUS.96Apr9184019@spectre.mitre.org>,
Robert I. Eachus <eachus@spectre.mitre.org> wrote:
>
>    I hope that everyone following this thread knows that this
>"undefined" behavior lead to one of the security holes exploited by
>the Morris Internet worm.

No, this was something to do with gets being applied to an automatic buffer.
If you picture the downward growing stack on a Sun3 or VAX, imagine what you
can do if you can overrun a stack array variable with bytes that spell out
machine code. If you are clever, you can overwrite the buffer in such a way
that the return address on the stack is modified to jump to the other portions
of your array. This can be done thanks to absolute addressing on a machine with
virtual address spaces, where each process always starts out with the same
stack pointer value. Once you jump to your array, you have control of the
machine. You can do system calls galore---and if you are running under euid 0,
you are God.

I should try this under Linux just for fun.

The POSIX.1 standard was not even around then, by the way.

>    Undefined only means unusable in some contexts, and if the C read
>had a way to know the size of the buffer passed, that particular
>security hole would not have existed.

That much is true, modulo s/read/gets/

The read function has a way to know the buffer size, namely the nbytes
argument. (There is no read in C, by the way) The gets() function has no such
argument and should be avoided like the plague except in totally trivial,
makeshift programs or in debugging.

There are still some old-timer bugs that plague (commercial) UNIX: try typing a
!%s%s%s%s  command to the C shell (not tcsh, but the more crappy real one that
you actually _pay_ for when you buy a SVR4 unix).   It tries to tell you that
the %s%s%s%s event is not found in the history. But guess what? It uses
raw printf(), so the %s's get interpreted as format strings. The function looks
for non-existent arguments, resulting in strange behavior, like crap being
printed on the terminal.
--