25 ms·
Printable True Bugs Wait Posters
- facepalm 13y agoNice - although I wish they would fix the bugs in those libraries, too.
- danielweber 13y agoMany of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do. Also, what's pickle? PS: don't type "man pickle" into the google, you won't like it.
- PhantomGremlin 13y agoGoogling for "python pickle" will provide more benign search results.
- Piskvorrr 13y agohttps://wiki.python.org/moin/UsingPickle https://wiki.python.org/moin/UsingPickle
- anonymoushn 13y agoPickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
- pekk 13y agoNot accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
- dalke 13y agoanonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."
- nightpool 13y agoProbably the python memory serialization library, which is known to be really dangerous if you use on untrusted input. http://docs.python.org/2/library/pickle.html http://docs.python.org/2/library/pickle.html
- emillon 13y agopickle is a (de-)serialization library for Python. It allows arbitrary code evaluation, so shouldn't be exposed to the outside world (for the same reason that we have JSON parsers and don't use JS eval() to parse JSON).
- Noughmad 13y agoConsidering the poster mentions serialization, I would say it's about this: http://docs.python.org/3/library/pickle.html http://docs.python.org/3/library/pickle.html
- deleted 13y ago[deleted]
- i_c_b 13y agoWhen I was working at a game dev studio on a game that partially took place in a city, we had an artist, looking for photo reference, type in "man hole" in the google image search. The resulting photo reference, in addition to being rather NSFW, was not useful for the particularly game we were making.
- Sharlin 13y agoHow do you mean? strcpy and friends aren't buggy - they work according to the spec, and you can't just go and change an API that literally billions of lines of code depend on. You can only provide new, better alternatives. If you mean the buggy software that uses the unsafe C APIs (and is not careful enough), then, that's exactly what those posters are about.
- nullc 13y agoI'm pretty sure those posters are making fun of the thinking that says you can just use some replacements and magically be safe. The 'safe' versions of the functions have their own risks too. No amount of use-this-thing is a replacement for conscientious programming and review.
- lowmagnet 13y ago(Not a C person here, but I'll ask anyway) What should I use instead of these things if they're so dangerous?
- danielweber 13y agoAlmost every one has a n version you should use, and their man pages will tell you that. strcpy -> strncpy (or strlcpy on BSD) strcat -> strncat (or strlcat on BSD) sprintf -> snprintf (but still watch out for printf format attacks) gets -> something else entirely. The man page says "programs should NEVER use gets()".
- tptacek 13y agoThey told me if I used the n version I'd be safe. They told me the risks were tiny. That all we had to do was practice safe counting. They told me that... ˚sob˚ but they were wrong.
- fromdoon 13y agoHi, Is there any resource on Web or even any book that documents all the risks. I had once seen a talk given by you .. was good !! Any other such resources out there ??
- tptacek 13y agoI like _The Art of Software Security Assessment_ for this.
- _telemachus 13y agoGood for laughs. Thanks. Now the serious follow up: Ok, what else should someone do? Programs (often) handle text. Apparently, that pretty much means you're fucked. So what is a reasonable way to write such programs?
- dllthomas 13y ago
- dmm 13y agoDevelop your c code in OpenBSD. The linker admonishes you any time you use unsafe string functions. warning: strcpy() is almost always misused, please use strlcpy()
- groovy2shoes 13y agoBy default, Microsoft's C compiler will also give you warnings for unsafe functions. At least, it did the last time I used it a few years ago.
- ygra 13y agoIt still does. Microsoft also banned a lot of C functions from usage internally [1]. For codebases that need to build in VC and other compilers I'm not yet sure how to really solve this apart from _CRT_SECURE_NO_WARNINGS. [1]: http://msdn.microsoft.com/library/bb288454.aspx http://msdn.microsoft.com/library/bb288454.aspx
- anon4 13y agoHow about just taking BSD's functions and using them? strlcpy, strlcat, snprintf, etc. are all easily portable and libraries probably already exist for MS's compiler.
- nitrogen 13y agoThe thing I didn't like about Microsoft's approach is that they also flagged some of the safer C functions, and introduced a new bunch of non-standard functions, the *_s functions. Those functions were eventually added to the C11 standard at Microsoft's suggestion, but until that point the MS C compiler would admonish programmers to write unportable code.
- raverbashing 13y agoOr even better, don't use C for string handling. It's too much trouble for too little gain. I think the areas where C is a good and effective solution are shrinking and safer languages are becoming more common and faster (even C++) The C syntax, not its library doesn't allow for good string handling. String handling should be built deeper into the language, and, yes, even though it is possible to have safe C code, it's very hard. So try when it's worth it.
- TheAnimus 13y agoThis is the point people often miss-understand when discussing different programming languages. Few languages prevent you doing anything. No one claims they do. The point is some languages encourage you to do things correctly, others, make it an uphill struggle.
- nitrogen 13y agoSaying C is "very hard" is useful to dissuade the unprepared from writing buggy, vulnerable software, but for the experienced developer with modern tools, C is at worst "tedious". Some simple habits, like always writing your malloc() and free() calls at the same time in balanced pairs, can make C quite managable. Add valgrind, unit tests, and static analysis, and I'd have much more confidence in a good C program than an average program in a weakly typed language.
- shadowmint 13y agoI'm pretty sure the its very hard refers to string handling in C, and also fairly solid in my agreement that unless you have a very very good reason, that is one of the places most people are better off staying away from (especially once you start playing with C unicode constructs). (but your point is totally valid with regard to C in general~)
- plumeria 13y agoIs there a good string handling library for C?
- skywhopper 13y agoObviously strcpy is dangerous, that's why I copy all my strings by hand with: while(*dest++ = *src++);
- delinka 13y agoI really hope this was sarcasm. But if not... There's nothing here to prevent a buffer overrun. If your src doesn't end in 0, or your dest is too small, you'll be reading memory you shouldn't and/or obliterating memory past your dest buffer. Your method is pretty much on par with an inlined strcpy.
- angersock 13y agoI don't always copy strings, but when I d8$#@C11&C^C^CSegmentation Fault
- jere 13y agoIf you don't write C very often (I don't) and you want to see these things in action: https://microcorruption.com https://microcorruption.com I had no clue printf was problematic.
- minimax 13y agoIn this case I don't think they are warning about format string vulnerabilities. The poster mentions sprintf (not printf) so presumably they are warning you about overflowing the destination buffer. I'm also having a super fun time with the microcorruption challenges. Highly recommend.
- meowface 13y agoprintf (and others in that family of functions) are only exploitable if you do something like `printf(user_controlled_str)` (possibly with extra arguments). Basically, don't let the user control the very first argument (which would allow them to add format specifiers like %d or %x) and you're safe.
- jere 13y agoWell, yea. This is exactly what you do in a few levels of microcorruption. You can always say "dont do X and you'll be fine." But that's kind of like saying "don't point a gun at someone" and the gun will be completely harmless. That's the trick, isn' it? That seems to be the point of the "True bugs wait" site at least. It only takes one mistake.
- meowface 13y agoI agree, especially with things like strcpy and strcat, but printf is kind of a special case because it's a very, very simple rule to follow. Plus most of the time it's illogical to use it without a format specifier (or with user supplied ones).
- deleted 13y ago[deleted]
- infruset 13y agoWhat are those ads referring to originally? Is this a campaign in the US? Is it publicly funded?
- bestdayever 13y agoA lot of older pregnancy awareness campaigns were all about abstinence in the USA. It is only recently that people have realized it doesn't work and things have been changing to advocating condom use etc.
- lostcolony 13y agoIt's not "older", it's "Republican". There are still states that predominantly teach abstinence (looking at you, Texas, https://www.dshs.state.tx.us/abstain/ https://www.dshs.state.tx.us/abstain/), and any mention of contraceptives as both a means to reduce the risks of pregnancy, and of STDs, are mostly at the teacher's discretion, rather than a mandatory part of the course work.
- Nursie 13y agoSexual abstinence. And yes IIRC they are publicly funded in some states. Worse, they either don't give accurate information about contraception or give no information at all. Needless to say, these policies have proven to be counterproductive when it comes to actual teen pregnancy and STI rates.
- Bluestrike2 13y agoNot that the negative correlation between abstinence only programs and pregnancy + STI rates deters the people who push them. When you start to view public health policy through the lens of individual morality (if not piety in some cases), the actual effects of a given policy effectively become irrelevant next to the intent of the policymakers. To the unfortunate consequence of many teenagers.
- Nursie 13y ago
- infruset 13y agoWhat are those ads referring to originally? Is this a campaign in the US? Is it publicly funded?
- deleted 13y ago[deleted]
- TeMPOraL 13y agoPro tip: when you develop with gcc, don't settle for anything less than gcc -ansi -pedantic -Wall At university I often had people coming to me and asking, "my program compiles correctly, but it keeps crashing / doing weird things; what did I do wrong?". I always said, "add '-ansi -pedantic -Wall' to the compile flags and come back to me when you cleared that wall of warnings down to nothing". Every single time the problem was directly or indirectly caused by the things that were in the warning messages. It's a shame that the default choice of GCC flags make this compiler pretty much useless for work. The warnings are there to help you. You can choose to ignore them and that's fine, as long as you do it deliberately and with a damn good reason, not because you don't even know they're there.
- epsylon 13y agoNote: -ansi is equivalent to -std=c90 (in C mode). If you want C99 or C11 support, use -std=c99 or -std=c11.
- stephencanon 13y ago-ansi is one of the most poorly named compiler flags of all time; C11 is the current ANSI C standard, but compiling with -ansi in GCC specifies a language dialect that’s a quarter of a century old(!)
- dllthomas 13y agoIt was named when "ANSI or not ANSI?" was the interesting question, and stuck around for compatibility. It should be kept and its semantics should not be changed, but it should be called out as deprecated. At least the gcc man page does say "In C mode, this is equivalent to -std=c90. In C++ mode, it is equivalent to -std=c++98."
- thinkpad20 13y agoTrue, but colloquially, when people say "ansi C" they almost always mean C89.
- epx 13y agoI would like C to have a native String type, and the primitives could be function pointers, replaceable in those cases when custom handling is needed (e.g. inside kernel). Object Pascal is sort like that.
- eric_bullington 13y agoD has this. A lot of people assume that D is just C++ with some GC and some improvements, but it's really more like C with GC and some improvements -- including a native String type. There's also a string module in the standard library that includes a lot of convenience methods, including ones for interoperating with C and for working with Unicode[1]. For someone like me with a background in dynamic languages like Python and Lua, as well as some background in C, D was a great fit. Unlike when I started learning C++, D felt like a very natural extension of C to include GC and lots of modern language features. Lamentably, not many people are interested in D, and so aren't yet a lot of third-party libraries, and many of those that are abandoned. But the core language and standard library are great, and there's a nicely growing and incredibly fast web framework (vibe.d). And Facebook has started supporting the language. So hopefully it will start seeing some growth. 1. http://dlang.org/phobos/std_string.html http://dlang.org/phobos/std_string.html
- thinkpad20 13y agoI've gone down this route of thinking many times. Inevitably, as soon as I think of all of the features that I would want in C, I simply end up with a language that's not C any more... for precisely that reason. C isn't that kind of a language; it's a high-level assembly language and little more. Most of the things that C is lacking, it is by design, because of performance reasons and/or need for fine-grain control of the machine. As another respondent mentioned, there are other languages that fill that need (C++, D, Rust, Nimrod), basically all of the systems languages that are designed to do C's job easier and safer (but probably not faster).
- anon4 13y agoYou can always use something like bstring. It will always be compatible with other libraries that take a pointer and a length.
- benihana 13y agoNot a C guy. Why are these functions unsafe?
- Roboprog 13y agoHere, runtime, make some results and put them into this (character array) buffer I'm providing for you. Oh, the buffer wasn't big enough? Well, I'm sure the stuff after the buffer's end that you wrote over wasn't all that important, anyway. Probably just a few neighboring local variables that my function was storing nearby on the stack, or maybe the return address on the stack, or maybe the heap management data (block size field, free list pointer, ...) around the block of memory I allocated from the heap. I wonder what the next pass of my loop will do now, or what will happen when this function returns???
- tbrownaw 13y agoBecause C strings are arrays of characters terminated by a null ('\0') character, and arrays in C don't have bounds checking and don't come with a length attached. If you allocate a 10-element character array, it can hold strings of up to 9 characters (plus the null terminator). But, the library functions ("runtime") don't know how big it is. So if you try to copy a 20-character string into that 10-element buffer, it will copy 21 characters. The first 10 will go into the array, and the next 11 characters will go... somewhere else. Depending on where in memory your array and other things are, something important will probably get overwritten with garbage.
- orangeduck 13y agoHalf the people in this thread seem to have missed the point. This article is not supporting 100% abstinence of these functions. It is doing exactly the opposite - and showing up people who say "never do this" or "that is always wrong" as being as ridiculous as those who blindly support abstinence from sex. This kind of tunnel vision, learning by rote, and refusal to teach what is really happening, is exactly the same stupid attitude that creates bad programmers, as it creates unbalanced teenagers. Perhaps, just like condoms, memcpy, strcpy, strcat are dangerous or ineffective 10% of the time. But that other 90% of the time, when used correctly, they are perfectly safe, fun and essential to learning and growing. Avoiding them completely does not create a healthy relationship between a language and its programmer. I realize that not everyone in this thread is a C programmer, but this prevailing attitude of saying "this should never be done/used" just because you're heard that from someone else, is a really petty, annoying, and persistent aspect of programmer culture.
- shadowmint 13y agoPerhaps, but tested and true advertising methodology is 1) find a undeniable grain of truth, 2) wrap your message around it, so the consumer is confused into thinking your message is by association true too. You might be right about the sarcastic message 'wrapping', but these posters only work because the messages they're wrapped around are true. I certainly didn't come away from those posters going, 'dang, those guys... so over the top; there's nothing wrong with using strcpy, you're making a fuss about nothing'.
- michaelt 13y agoI'm a beginner C programmer, maybe you can share your experience with me. I've found bugs in libraries where sprintf was used instead of snprintf and it caused crashes. So I know from experience of cases where snprintf was a better choice than sprintf. And I've certainly coded a few off-by-one errors in my time so I can sure understand it's easy to get the destination buffer size wrong! I'm not doing anything performance-critical with strings. Under what circumstances should I use sprintf instead of snprintf and what benefits will I see?
- 13y ago
- yetanotherphd 13y agoEven though I don't think abstinence-only sex education is a good idea, it's strange that the true statement "only abstinence is 100% effective" is mocked. Or are liberals going to start teaching an honest version of their view: "A combination of condom use and abortion when condoms fail, is 100% effective"?
- gizmo686 13y agoI've only sees "only abstinence is 100% effective" mocked from a policy perspective. It is true that abstinence is 100% effective on a personal level, but teaching it is remarkably ineffective at a population level. There is room to mock it on a personal level, by pointing out that we are willing to engage in far more dangerous activities without 100% guarantees on safety. 'Seatbelts fail, only not driving is 100% effective'.
- yetanotherphd 13y ago>I've only sees "only abstinence is 100% effective" mocked from a policy perspective. It is true that abstinence is 100% effective on a personal level, but teaching it is remarkably ineffective at a population level. The phrase "only abstinence is 100% effective" is a slogan for teens, not a claim that only abstinence only sex education is 100% effective (which is clearly false). >There is room to mock it on a personal level, by pointing out that we are willing to engage in far more dangerous activities without 100% guarantees on safety. 'Seatbelts fail, only not driving is 100% effective'. It depends on how much a person wants to avoid having an abortion or unplanned pregnancy, and how much value they get out of sex.
- theseoafs 13y ago> The phrase "only abstinence is 100% effective" is a slogan for teens, not a claim that only abstinence only sex education is 100% effective (which is clearly false). You're misunderstanding the point -- "only abstinence is 100% effective" is mocked precisely because it is a remarkably bad way to get kids not to have premarital sex.
- 13y ago
- PaulHoule 13y agoFriends don't let friends program in C
- dllthomas 13y agoI would punch my friends if they tried to stop me.
- asgard1024 13y ago100% effective? Just wait until your friends invite you to a Hackathon, and all promises will be broken that night..
- paulrademacher 13y agoTrue bugs wait in haunted attics.