Should you always use ‘int’ for numbers in C, even if they are non-negative?

by

One thing that hasn’t been mentioned is that interchanging signed/unsigned numbers can lead to security bugs. This is a big issue, since many of the functions in the standard C-library take/return unsigned numbers (fread, memcpy, malloc etc. all take size_t parameters)

For instance, take the following innocuous example (from real code):

//Copy a user-defined structure into a buffer and process it
char* processNext(char* data, short length)
{
    char buffer[512];
    if (length <= 512) {
        memcpy(buffer, data, length);
        process(buffer);
        return data + length;
    } else {
        return -1;
    }
}

Looks harmless, right? The problem is that length is signed, but is converted to unsigned when passed to memcpy. Thus setting length to SHRT_MIN will validate the <= 512 test, but cause memcpy to copy more than 512 bytes to the buffer – this allows an attacker to overwrite the function return address on the stack and (after a bit of work) take over your computer!

You may naively be saying, “It’s so obvious that length needs to be size_t or checked to be >= 0, I could never make that mistake”. Except, I guarantee that if you’ve ever written anything non-trivial, you have. So have the authors of Windows, Linux, BSD, Solaris, Firefox, OpenSSL, Safari, MS Paint, Internet Explorer, Google Picasa, Opera, Flash, Open Office, Subversion, Apache, Python, PHP, Pidgin, Gimp, … on and on and on … – and these are all bright people whose job is knowing security.

In short, always use size_t for sizes.

Man, programming is hard.

More Related Contents:

  1. Do you use the TR 24731 ‘safe’ functions? [closed]
  2. Setting variable to NULL after free
  3. Opaque C structs: various ways to declare them
  4. sizeof with a type or variable
  5. Parenthesis surrounding return values in C
  6. srand function is returning same values
  7. Should useless type qualifiers on return types be used, for clarity?
  8. Why do most C developers use define instead of const? [duplicate]
  9. Why declare a struct that only contains an array in C?
  10. Triple pointers in C: is it a matter of style?
  11. Why is it assumed that send may return with less than requested data transmitted on a blocking socket?
  12. Using true and false in C
  13. Do you prefer “if (var)” or “if (var != 0)”? [closed]
  14. Ignoring return values in C
  15. Why is “typedef struct foo foo;” considered harmful?
  16. Need for prefixing a function with (void)
  17. Convert double * to double [9] in C [closed]
  18. I need help understanding this code in C [closed]
  19. After running code, the output is always zero
  20. How do I use extern to share variables between source files?
  21. Error “initializer element is not constant” when trying to initialize variable with const
  22. Can we change the value of an object defined with const through pointers?
  23. Why does GCC allocate more space than necessary on the stack, beyond what’s needed for alignment?
  24. An example of use of varargs in C
  25. Checking if a pointer is allocated memory or not
  26. Is there a built-in way to swap two variables in C?
  27. Implementation of sizeof operator
  28. How to use function srand() with time.h? [duplicate]
  29. Can’t step into string.h function with GDB
  30. Is it Undefined Behaviour to cast away the constness of a function parameter?

Leave a Comment