C ++ memset / memcpy / strcpy实现-检查缓冲区溢出

Question

I have made basic memset / memcpy / strcpy implementations in C++, which work fine. However, is there a way of detecting buffer overflows if I was to do something like this:

Example:

int main()
{
    char *buf = (char *)calloc(10, sizeof(char));
    __strcpy(buf, "Hello World"); 
    // buffer size: 10, copy size: 12 (including '\0') - overflow
}

Implementations ( typedef unsigned int UINT ):

void *__memset(void *_Dst, int _Val, UINT _Size)
{
    UINT *buf = (UINT *)_Dst;
    while (_Size--)
    {
        *buf++ = (UINT)_Val;
    }
    return _Dst;
}

void *__memcpy(void *_Dst, const void *_Src, UINT _Size)
{
    UINT *buf = (UINT *)_Dst;
    UINT *src = (UINT *)_Src;
    while (_Size--)
    {
        *buf++ = *src++;
    }
    return _Dst;
}

char *__strcpy(char *_Dst, const char *_Src)
{
    while ((*_Dst++ = *_Src++) != '\0');
    return _Dst;
}

Answer 1

Buffer overflows are not detectable in your program. The operating system is detecting them. You only can check for potential pitfalls in the code (if/else,asserts,exceptions). Or you use profiling tools like valgrind.

Answer 2

You can detect overflows, but only if you also implement your own memory-management routines. We used to do this when we wrote embedded software that ran on devices without a "real" operating system, before there were very many good debugging tools.

The idea is to build your own wrapper around malloc() (and calloc() , in your case), that will allocate a few more bytes than the caller requests. Then set up a few "guard bytes" before and after the memory that was requested and initialize the entire buffer with recognizable data. Also build a wrapper around free() that checks for the guard bytes before releasing the memory and generates an error if they've changed.

#define GUARD_LEN = 4   // Arbitrary number of guard bytes.
#define GUARD_BYTE = 0xA5  // Arbitrary but recognizable: 10100101b
#define UNUSED_BYTE = 0x96 // Arbitrary but recognizable: 10010110b
#define FREED_BYTE = 0xC3  // Arbitrary but recognizable: 11000011b
#define MAX_ALLOCS = 1024  // Max # of malloc'ed buffers.
struct {
  void *addr;  // Address of malloc'ed buffer
  size_t len;  // Number of requested bytes
} Allocs[MAX_ALLOCS];

// Allocates and initializes memory.
void *chk_malloc(size_t length) {
  // Allocate memory for buffer + guard bytes.
  void *mem = malloc(length + 2*GUARD_LEN);
  if (mem == NULL) {
    return NULL;
  }

  // Initialize: [GUARD][UNUSED_BUFFER][GUARD]
  // Caller's usable memory starts after GUARD.
  void *buffer = mem + GUARD_LEN;
  memset(mem, GUARD_BYTE, GUARD_LEN);
  memset(buffer, UNUSED_BYTE, length);
  memset(buffer + length, GUARD_BYTE, GUARD_LEN);

  // Remember the address and length.
  // Simplified for demonstration; you may want this to be smarter.
  for (int i = 0; i < MAX_ALLOCS; ++i) {
    if (Allocs[i].addr == NULL) {
      Allocs[i].addr = buffer;
      Allocs[i].len = length;
      return buffer;
  }
  return NULL;  // Should also indicate MAX_ALLOCS is too small.
}

// Checks that buffer is filled with val.
bool chk_filled(void *buffer, char val, size_t len) {
  for (int i = 0; i < len; ++i) {
    if (buffer[i] != val) {
      return false;
    }
  }
  return true;
}

// Checks for over/underrun and releases memory.
void chk_free(void *buffer) {
  // Find the buffer in the array of alloc'ed buffers.
  for (int i = 0; i < MAX_ALLOCS; ++i) {
    if (Allocs[i].addr == buffer) {
      void *guard = buffer - GUARD_LEN;  // Initial guard bytes.
      if (!chk_filled(guard, GUARD_BYTE, GUARD_LEN)) {
        // Underrun
      }
      end_guard = buffer + Allocs[i].len;    // Terminal guard bytes.
      if (!chk_filled(end_guard, GUARD_BYTE, GUARD_LEN)) {
        // Overrun
      }

      // Mark the buffer as free and release it.
      memset(guard, FREED_BYTE, Allocs[i].len + 2*GUARD_LEN);
      Allocs[i].addr = -Allocs[i].addr;  // See text below.
      free(guard);
      return;
    }
  }
  // Error: attempt to free unalloc'ed memory.
}

In reality you'd probably want this to be smarter in several ways:

• You might not want to have a limit of MAX_ALLOCS .
• Check for allocated memory that isn't freed when the program exits.
• Print Allocs[] on exit.
• Print more information and/or exit immediately when an error is detected.

Answer 3

The safer way to detect buffer overflows is by providing your own implementation of calloc instead. Provide a few bytes padding before and after the returned block, set them to a known value (NOT 0 or 255), and when calling free check that they're untouched. Also, after calling free you should overwrite the whole block (including the padding on both sides) to check for double free calls.

Answer 4

All your mem* functions are invalid. They copy (or set) objects of type unsigned int while they have to copy (or set) objects of type unsigned char. Take into account that __Size can be an odd number. These functions theirself are unable to check buffer overflow without changing their declarations.

Also even the third function is invalid

char *__strcpy(char *_Dst, const char *_Src)
{
    while ((*_Dst++ = *_Src++) != '\0');
    return _Dst;
}

inside the function pointer _Dst was changed and points to the terminating zero. This address you return from the function while you have to return the address of the first character of the string pointed by _Dst.

The same is valid for the first two functions.

Answer 5

You may need the size of buffer you are owing, which can be used to iterate that many locations to copy checking buffer overflow if any as shown below,

char *__strcpy(char *_Dst, const char *_Src, int size)
{
   while ((*_Dst++ = *_Src++) != '\0' && size--); //Iterate/copy to allocated Bytes
   return _Dst;
}

int main()
{
    int size;
    char *buf = (char *)calloc(size, sizeof(char)); // Here you know the size of buf
    __strcpy(buf, "Hello World", size);  // Send size as parameter
   // buffer size: 10, copy size: 12 (including '\0') - overflow
}

Answer 6

There can be a real C++ implementation, if you use arrays instead of pointers to char. You could define your functions as template and make the array size a template argument.

template < std::size_t D >
char* strcpy( char ( &dest )[ D ], const char* source )
{
    assert( D > std::strlen( source ) );
    ...
}

As you really just need the destination size, I've left the source size out.

int main()
{
    char buf[ 10 ];
    // would assert, if assertions are enabled.
    strcpy( buf, "Hello World" ); 
}