Lack of understanding of security engineering in simple C code

Question

I am absolutely new to C programming. Currently I am preparing for my new course of studies IT Security. In a slightly older exam I found a task where I have no approach how to solve it. The task is in German. In principle it is about finding critical errors.

It is not written how the passed parameters look like.

1) I have come to the point that you should not use strcpy because it has no bounds checking.

2) Also char[10] should not be used if you want to store 10 characters (\0). It should be char[11].

Is it possible to read Adresses or write sth due the printf(argv[1]) command?

I would like to mention again that you help me here personally and do not help to collect bonus points in the university.

#include <stdio.h>

int main(int argc, char *argv[])
{
    char code[10];

    if(argc != 2) return 1;
    printf(argv[1]);

    strcpy(code, "9999999999");
    for(int i = 0; i < 10; ++i){
        code[i] -= argv[1][i] % 10;
    }

    printf(", %s\n", code);

    return 0;
}

Answer 1

See related .

you should not use strcpy() because it has no bounds checking

Nothing in C has bounds checking unless either

• the compiler writer put it there, or

• you put it there.

Few compiler writers incorporate bounds checking into their products, because it usually causes the resulting code to be bigger and slower. Some tools exist (eg Valgrind , Electric Fence ) to provide bounds-checking-related debugging assistance, but they are not commonly incorporated into delivered software because of limitations they impose.

You absolutely should use strcpy() if

• you know your source is a NUL-terminated array of characters, aka "a string", and

• you know your destination is large enough to hold all of the source array including the terminating NUL

because the compiler writer is permitted to use behind-the-scenes tricks unavailable to compiler users to ensure strcpy() has the best possible performance while still providing the behaviour guaranteed by the standard.

char[10] should not be used if you want to store 10 characters (\0)

Correct.
To store 10 characters and the terminating NUL ( '\0' ), you must have at least 11 characters of space available.

Is it possible to read Adresses or write sth due the printf(argv[1]) command?

In principle: maybe.

The first argument to printf() is a format string which is interpreted by printf() to determine what further arguments have been provided. If the format string contains any format specifications (eg "%d" or "%n" ) then printf() will try to retrieve corresponding arguments. If they were not in fact passed to it, then it invokes Undefined Behaviour which is Bad. An attacker could run your program giving it a command-line argument containing format specifiers, which would lead to such UB.

The right way to print an arbitrary string like this with printf() is printf("%s", argv[1]);