NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·3h ago
Security
Trail of Bits Blog·May 5·8 min read
C/C++ checklist challenges, solved
TL;DR
C/C++ developers often miss subtle security vulnerabilities in common patterns like buffer management and type handling. Trail of Bits published a security checklist with two code challenges: a Linux ping utility and a Windows registry handler, each containing exploitable bugs.
✦ Why It Matters
Engineers can use this checklist to audit C/C++ code for inet_ntoa misuse and Windows registry type validation, preventing kernel exploits.
Key Takeaways
- Validate all user inputs to prevent command injection.
- Avoid using functions that return pointers to global buffers.
- Implement strict checks for registry queries in drivers.
- Regularly update security practices based on new findings.
How It Works
The checklist provides a systematic approach to identifying vulnerabilities, using specific examples to illustrate common pitfalls in C/C++ programming. For instance, the inet_aton function's undocumented behavior allows for unexpected inputs, while the inet_ntoa function's global buffer can lead to overwrites, creating security risks.