Computer Security
sulan.
exercise.docxExercise 10.1 Will this while loop terminate? If yes, after how many iterations? Does the result change if the variables are unsigned integers instead of signed integers?
int i = 1;
int c = 1;
while (i › 0)
{
i = i * 2; c++;
}
Business software stores dates in the binary-coded decimal (BCD) format. Decimal digits are encoded in four bits by their binary representation. A byte stores two decimal digits. For which days of the month, for which months of the year, and for which years is the binary value stored in a byte different from its BCD value?
Exercise 10.3 Give a fix for the flaw in the code for concatenating two strings discussed in Section 10.2.3.
Exercise 10.4 An alternative design for a canary mechanism places the NULL value just below the return address. What is the rationale for this design decision? When does this method meet its objectives, and what are its limitations?
Exercise 10.5 What is the flaw in the code snippet below that fills a buffer with zeros? How can the problem be fixed?
char* buf;
buf = malloc(BUFSIZ);
memset ( buf, 0, BUFSIZ );
Exercise 10.6 You are given chunks whose length is a multiple of 16 bytes. For each size of chunk, there is a separate bin. The following instruction takes the size of a chunk in bytes and calculates the index of the bin the chunk belongs to:
#define bin_index(size)
( ( ( (unsigned int)(size) ) >> 3) - 2)
Why is this instruction vulnerable to a buffer overrun attack?
Exercise 10.7 Unix systems use environment variables to configure the behaviour of utility programs. A program executing another program can setthe environment variables for that program. How could this fact be used in an attack? What defences should programmers apply?
Exercise 10.8 Consider a memory system that stores free blocks in a double- linked list IDX in ascending order of size. A free block P of size S is inserted using the frontlink command given below. Blocks are taken from the list using unlink. How does this system react when a block that is already in the free list is added again, and removed later?
#define frontlink(A, P, S, IDX, BK, FD)
...
[1] FD = start_of_bin(IDX);
[2] while ( FD != BK && S ‹ chunksize(FD) )
[3]
{
FD = FD-›fd;
}
[4] BK = FD-›bk;
[5] P-›bk = BK;
[6] P-›fd = FD;
[7] FD-›bk = BK-›fd = P;
}
Exercise 10.9 Analyze how frontlink could be exploited in a memory cor- ruption attack.
Exercise 10.10 Design a scalable protection mechanism for chunks that uses canaries without having to store reference values for all canaries.
Exercise 10.11 You are given an archiving function that writes to a zip archive storing files with their directory path. Extraction from the archive restores files at the location given. How could an attacker working in user mode who has no access to the root directory or to /etc, and who is not permitted to archive /etc/passwd, overwrite this file?
Exercise 10.12 Define test cases for frontlink and unlink.
Exercise 10.13 Determine the sanitization functions and trust sinks in a taint
analysis of PHP scripts that addresses cross-site scripting attacks (Section 18.4).
