Re: A way to prevent buffer overflow exploits?

> [Yes and no. That's certainly the correct solution, but C and C++ give
> you no help at all in that regard, with routines like sprintf which
> will cheerily write arbitrarily long results and smash off the end of
> a buffer. -John]


The buffer overflow issue dates back to fundamental design deficiencies in
the original C streams library which was made part of ANSI-C almost
verbatim. Amazingly people are still re-implementing this 'broken
standard' without concern for its problems. Some years ago AT&T wrote a
new - far superior - streams library called sfio. It is documented in the
book Practical Reusable Unix Software (see
http://portal.research.bell-labs.com/orgs/ssr/book/reuse/). I gather reuse
of the sfio library is free (in the no-fee sense).


R.
[If only one could get it into the C standard. Actually, it looks like
the new standard will have stuff like snprintf which make it easier to
avoid buffer overflow problems, if only people will use them. -John]
--

Return to the comp.compilers page.
Search the comp.compilers archives again.