Testing Techniques to Find the Sin

Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise

Shortly after this problem was announced in June, 2002, widespread attacks were seen against affected IIS servers. More details can be found at www.microsoft.com/ technet/security/Bulletin/MS02-028.mspx, but the root cause was because the HTR handler accepted a length of 64K - 1 from the user , added 1after all, we needed room for the null terminatorand then asked the memory allocator for zero bytes. Its not known whether Bill Gates really said 64K ought to be enough for anybody or if thats an Internet legend, but 64K worth of shell code ought to be enough for any hacker to cause mayhem!

Redemption Steps

Redemption from integer overflows can only truly be had by carefully studying and understanding the problem. That said, there are some steps you can take to make the problem easier to avoid. The first is to use unsigned numbers where possible. The C/C++ standard provides the size_t type for (you guessed it) sizes, and a smart programmer will use it. Unsigned integers are much, much easier to verify than signed integers. It makes no sense to use a signed integer to allocate memory!

Avoid clever codemake your checks for integer problems straightforward and easy to understand. Heres an example of a check for addition overflows that was too smart by half:

int a, b, c;

c = a + b;

if(a ^ b ^c < 0)
 return BAD_INPUT;

This test suffers from a lot of problems. Many of us need a few minutes to figure out just what it is trying to do, and then it also has a problem with false positives and false negatives it only works some of the time. Another example of a check that only works some of the time follows :

int a, b, c;

c = a * b;

if(c < 0)
 return BAD_INPUT;

Even allowing for positive inputs to start with, the code only checks for some overflowsconsider (2^30 + 1) * 8; thats 2^33 + 8and once truncated back to 32-bit, it yields 8, which is both incorrect and not negative. A safer way to do the same thing is to store a 32-bit multiplication in a 64-bit number, and then check to see if the high order bits are set, indicating an overflow.

For code like this:

unsigned a,b;
...
if (a * b < MAX) {
 ...
}

you could simply bound the a and b variables to a value you know is less than MAX. For example:

#include "limits.h"

#define MAX_A     10000
#define MAX_B    250

assert(UINT_MAX / MAX_A >= MAX_B); // check that MAX_A and MAX_B are small enough

if (a < MAX_A && b < MAX_B) {
 ...
}

size_t CalcAllocSize(int HowMany, int Size, int HeaderLen)
{
 try{
    SafeInt<size_t> tmp(HowMany);
    return tmp * Size + SafeInt<size_t>(HeaderLen);
 }
 catch(SafeIntException)
 {
 return (size_t)~0;
 }
}