Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security software engineer is performing a code audit on an enterprise data processing service written in C. The service reads user-supplied binary data streams containing a length header field (lengthlength) and a payload array (datadata). During review, the engineer identifies the following code segment used to process incoming data chunks:

c
unsigned short length = get_user_header_length();
char *buffer = (char *)malloc(length + 1);
if (buffer == NULL) return -1;
memcpy(buffer, user_data, length);
buffer[length] = '\0';

Based on this code snippet, which of the following vulnerabilities and security risks are present in this implementation? (Select TWO)

  1. Integer overflow during size calculation that can lead to an undersized memory allocationAnswer
  2. B
    Stored SQL injection flaw caused by raw user data being passed into database parameters
  3. Heap-based buffer overflow during copying due to mismatched memory buffer sizingAnswer
  4. D
    Missing authentication control allowing unauthorized access to administrative privileges

Answer

The implementation contains an integer overflow vulnerability in the allocation size arithmetic and a subsequent heap-based buffer overflow during the memory copy operation.
An integer overflow occurs when length+1length + 1 wraps to 0 for a maximum 16-bit unsigned short value (6553565535). This causes `malloc(0)` to allocate insufficient heap memory, while `memcpy` attempts to copy 6553565535 bytes into that buffer, resulting in a heap-based buffer overflow.

Step-by-Step Solution

1
Analyze the size calculation arithmetic
If length=65535length = 65535 (the maximum value for a 16-bit unsigned short), computing length+1length + 1 wraps around to 00 due to integer overflow.
Unsigned integer arithmetic wraps around without throwing an exception when a value exceeds the storage capacity of its data type.
2
Evaluate the buffer allocation behavior
The function `malloc(0)` allocates a 0-byte (or minimal chunk header) buffer on the heap.
The memory allocator receives the wrapped arithmetic result (00 bytes) rather than the intended allocation size.
3
Trace the memory copy execution
The `memcpy` function executes using the original lengthlength value (6553565535), writing data far beyond the allocated buffer boundaries.
`memcpy` processes the un-truncated lengthlength variable, resulting in memory corruption on the heap.

Key Concept

Integer Overflow and Heap Buffer Overflow
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic