Secure Coding

Dr Adarsh Rag S
Department of CSE
Contact: 8951172344

Secure Coding Dr Adarsh Rag S 1

 Syllabus

▪ Formatted Output: Variadic Functions, Formatted Output

Functions, Stack Randomization, Mitigation Strategies.

Secure Coding Dr Adarsh Rag S 2

 Formatted Output

▪ The C standard includes formatted output functions like

printf() and snprintf(), which use a format string and accept a
variable number of arguments.

▪ These functions are commonly used in command-line

programs to provide information, as demonstrated in the
example program.

Secure Coding Dr Adarsh Rag S 3

 Formatted Output
▪ The program constructs a usage message using snprintf()
and outputs it with printf().

▪ While this implementation avoids buffer overflows, it

introduces a significant vulnerability: format string
vulnerabilities.

▪ Formatted output functions consist of a format string and a

variable number of arguments.

▪ The format string, in effect, provides a set of instructions that

are interpreted by the formatted output function.

▪ By controlling the content of the format string, a user can, in

effect, control execution of the formatted output function.

Secure Coding Dr Adarsh Rag S 4

 Formatted Output
▪ Formatted output functions are variadic, meaning that they
accept a variable number of arguments.

▪ Limitations of variadic function implementations in C

contribute to vulnerabilities in the use of formatted output
functions.

Secure Coding Dr Adarsh Rag S 5

 Variadic Functions

▪ The <stdarg.h> header provides macros and types for

handling variadic functions, allowing functions to accept a
variable number of arguments.

▪ It has replaced the older <varargs.h> header, which is now

deprecated.

▪ Variadic functions are declared using a fixed parameter list

followed by an ellipsis (...). Developers and users must
adhere to a contract ensuring proper use of the variable
arguments, as no type checking is performed on these
arguments.

Secure Coding Dr Adarsh Rag S 6

 Variadic Functions

▪ Key macros provided by <stdarg.h> include:

▪ va_start(): Initializes the argument list, requiring the last fixed

parameter to determine the starting point of the variable
arguments.

▪ va_arg(): Retrieves the next argument from the list and

advances the pointer.

▪ va_end(): Cleans up resources used by the argument list;

failure to call it results in undefined behavior.

▪ va_copy(): Copies an argument list (not used in the example

provided).

Secure Coding Dr Adarsh Rag S 7

 Variadic Functions

▪ The va_list type is used to manage the argument list, with

macros operating on this type.

▪ A termination condition for the argument list, such as a

sentinel value (e.g., -1 in the provided example), must be
defined to avoid errors like infinite processing or crashes.

Secure Coding Dr Adarsh Rag S 8

 Formatted Output Functions

▪ Formatted output function implementations differ significantly

based on their history.

▪ The formatted output functions defined by the C Standard

include the following:

▪ fprintf() writes output to a stream based on the contents of

the format string.

▪ printf() is equivalent to fprintf() except that printf() assumes

that the output stream is stdout.

▪ sprintf() is equivalent to fprintf() except that the output is

written into an array rather than to a stream.

Secure Coding Dr Adarsh Rag S 9

 Formatted Output Functions

▪ snprintf() is equivalent to sprintf() except that the maximum

number of characters n to write is specified.

▪ If n is nonzero, output characters beyond n–1st are

discarded rather than written to the array, and a null
character is added at the end of the characters written into
the array.

▪ vfprintf(), vprintf(), vsprintf(), and vsnprintf() are equivalent to

fprintf(), printf(), sprintf(), and snprintf() with the variable
argument list replaced by an argument of type va_list.

▪ These functions are useful when the argument list is

determined at runtime.
Secure Coding Dr Adarsh Rag S 10
 Stack Randomization

▪ Discusses format string vulnerabilities and how stack

randomization complicates but does not entirely prevent
exploitation.
Key points
▪ Format String Exploits:
▪ Exploits typically require specific values:
▪ Address to overwrite (e.g., a return address or GOT
entry).
▪ Address of shellcode (can be placed in the heap or data
segment instead of the stack).
▪ Distance between the argument pointer and format
string.
▪ Number
Secure Coding of bytes already written before a %u
Drconversion.
Adarsh Rag S 11
 Stack Randomization

▪ Impact of Stack Randomization:

▪ Stack randomization introduces unpredictability by inserting
random gaps in the stack.
▪ Despite this, relative distances between variables (e.g., the
format string and argument pointer) remain constant,
enabling attacks through careful calculation.
▪ Bypassing Randomization:
▪ Attackers can target more predictable areas like the Global
Offset Table (GOT) instead of stack addresses.
▪ Shellcode placement in the heap or data segment is more
predictable than the randomized stack.

Secure Coding Dr Adarsh Rag S 12

 Stack Randomization

▪ Writing Addresses in Two Words:

▪ On systems with alignment requirements, attackers can write
addresses in chunks (e.g., low-order and high-order words).
▪ Examples describe concatenating GOT addresses to format
strings and transferring control to shellcode via GOT entry
modification (e.g., exit() function).

Secure Coding Dr Adarsh Rag S 13

 Mitigation Strategies

▪ Mitigation Strategies for Format String Vulnerabilities

▪ 1. Disable %n Conversion Specifier
o Some implementations (e.g., Microsoft Visual Studio):
✔ Disable %n by default.
✔ Provide functions (e.g., set_printf_count_output()) to
enable %n when required.
o Eliminating %n universally is impractical due to backward
compatibility issues.

Secure Coding Dr Adarsh Rag S 14

 Mitigation Strategies

▪ 2. Exclude User Input from Format Strings

o Follow CERT C Secure Coding Standards:
✔ Exclude user input from format strings.
✔ Avoid allowing users full control over format strings.
▪ 3. Dynamic Use of Static Content
o Use static format strings whenever possible.
o For dynamic format strings:
✔ Restrict user control to predefined formats (e.g., hex or
%d).
✔ Example: Build format strings based on user input but limit
possibilities.
o Challenges: May not be practical for features like
internationalization.
Secure Coding Dr Adarsh Rag S 15
 Mitigation Strategies

▪ 4. Restrict Bytes Written

o Use precision fields in format specifiers to prevent
overflows:
✔ Example: sprintf(buffer, "Wrong command:
%.495s\n", user);.
o Prefer safer alternatives to vulnerable functions:
✔ Use snprintf() or vsnprintf() instead of sprintf() or
vsprintf().
✔ Specify maximum bytes to write, including the null
byte.

Secure Coding Dr Adarsh Rag S 16

 Mitigation Strategies

▪ 5. Secure Function Alternatives

o Use dynamic memory allocation for strings:
✔ Functions like asprintf() or vasprintf() allocate
adequate memory for output strings.
✔ Return a pointer that must be freed when no longer
needed.
o Considerations:
✔ These functions are GNU extensions, not standard
C/POSIX.
✔ Beware of non-standard or older implementations
(e.g., Linux libc4) with potential security issues.

Secure Coding Dr Adarsh Rag S 17

 Mitigation Strategies

▪ Disable %n when possible.

▪ Exclude or restrict user input in format strings.
▪ Use static content or controlled dynamic content.
▪ Adopt safer formatted output functions (snprintf, asprintf).
▪ Always validate input and test for buffer overflows.

Secure Coding Dr Adarsh Rag S 18

Secure Coding Dr Adarsh Rag S 19