C语言中的安全问题

C 是一种非常强大且流行的编程语言。它最初是在 1970 年代开发的。 C语言用于编程网络驱动程序、解释器和编译器等。
尽管 C 语言广泛用于不同的系统，但它仍然存在许多与之相关的安全漏洞。本文重点讨论 C 语言中的安全漏洞。这些安全问题主要与易受攻击的库函数、数组和指针的无边界检查有关。

易受攻击的库函数：
CWE 代码：CWE – 242、CWE – 120、CWE-77

1.缓冲区和内存相关：

一种。 gets() ：此函数是 C 语言标准输入输出库的一部分。它没有对缓冲区大小的任何检查，恶意输入很容易导致缓冲区溢出。
下面是演示上述概念的 C 程序 -

C

// C program to implement
// the above approach
#include 
 
// Driver code
int main()
{
    char buf[24];
    printf("Please enter your name and press \n");
    gets(buf);
    printf("%s", buf);
    return 0;
}

C

// C program to implement
// the above approach
#include 
#define MAX 15
 
// Driver code
int main()
{
    char buf[MAX];
    fgets(buf, MAX, stdin);
    printf("%s", buf);
    return 0;
}

C

// C program to implement
// the above approach
#include 
#include 
 
// Driver code
int main()
{
    char str1[2];
    char str2[] = "GeeksforGeeks";
    strcpy(str1, str2);
    printf("Copied string is: %s\n", str1);
    return 0;
}

C

// C program to implement
// the above approach
#include 
#include 
#define BUFFER_SIZE 24
 
// Driver code
int main()
{
    // 24 is the buffer size
    char str1[BUFFER_SIZE];
    char str2[] = "GeeksforGeeks";
 
    // Limits number of characters
    // to be copied
    strncpy(str1, str2, BUFFER_SIZE);
    printf("Copied string is: %s\n", str1);
    return 0;
}

C

// C program to implement
// the above approach
#include 
#include 
#include 
 
// Driver code
int main()
{
    char str[40];
    fgets(str, 39, stdin);
    system(str);
    printf("%s", str);
}

C

// C program to implement
// the above approach
#include 
 
// Driver code
int main()
{
    char str[5];
    sprintf(str, "%s",
            "GGGGGGGGGGGGGG");
    printf("%s", str);
}

C

// C program to implement
// the above approach
#include 
 
// Driver code
int main()
{
    int val = 1;
    int* p = NULL;
    *p = val;
    printf("%d", *p);
    return 0;
}

C

// C program to implement
// the above concept
#include 
 
// Driver code
int main()
{
    int val = 1;
    int* p = NULL;
    if (p == NULL) {
        printf("Pointer is NULL");
    }
    else {
        *p = val;
        printf("%d", *p);
    }
    return 0;
}

C

// C program to implement
// the above approach
#include 
int* fun()
{
    int y = 10;
    return &y;
}
 
// Driver code
int main()
{
    int* p = fun();
    printf("%d", *p);
    return 0;
}

C

// C program to implement
// the above approach
#include 
#include 
 
// Driver code
int main()
{
    int n = 5;
    int* ptr;
    ptr = (int*)malloc(n * sizeof(int));
 
    // Memory has been successfully allocated
    printf("Memory successfully allocated using malloc.\n");
 
    // Free the memory
    free(ptr);
    printf("Malloc Memory successfully freed.\n");
 
    // freed pointer set to NULL value
    ptr = NULL;
 
    return 0;
}

C

// Program to demonstrate
// accessing array out of bounds
#include 
int main()
{
    int arr[] = { 1, 2, 3, 4, 5 };
    printf("arr [0] is %d\n", arr[0]);
    printf("arr[10] is %d\n", arr[10]);
 
    // allocation memory to out of bound
    // element
    arr[10] = 11;
    printf("arr[10] is %d\n", arr[10]);
    return 0;
}

C

// C program to implement
// the above approach
#include 
int arr[5];
 
// Driver code
int main()
{
    int size = sizeof(arr) / sizeof(arr[0]);
 
    for (int i = 0; i < size; i++) {
        scanf("%d", &arr[i]);
    }
 
    // Print elements of array
    for (int i = 0; i < size; i++) {
        printf("%d ", arr[i]);
    }
    return 0;
}

C

// C program to implement
// the above approach
#include 
int getValueFromArray(int* arr,
                      int size,
                      int index)
{
    int value = -1;
 
    // only maximum limit is there
    if (index < size) {
        value = arr[index];
    }
    return value;
}
 
// Driver code
int main()
{
    int arrtest[] = { 1, 2, 3, 4, 5 };
    int j = getValueFromArray(arrtest, 5, -1);
    printf("%d", j);
    return 0;
}

C

// C program to implement
// the above approach
#include 
int getValueFromArray(int* arr,
                      int size,
                      int index)
{
    int value = -1;
 
    // only maximum limit and minimum
    // limit is there
    if (index >= 0 && index < size) {
        value = arr[index];
    }
    return value;
}
 
// Driver code
int main()
{
    int arrtest[] = { 1, 2, 3, 4, 5 };
    int j = getValueFromArray(arrtest, 5, -1);
    printf("%d", j);
    return 0;
}

警告：

prog.c: In function ‘main’:
prog.c:10:1: warning: implicit declaration of function ‘gets’
[-Wimplicit-function-declaration]
gets(buf);
^
/tmp/ccmwzcCQ.o: In function `main’:
69c380139e12adbab30e0550af51f5a9.c:(.text+0x2e): warning: the `gets’
function is dangerous and should not be used.