נתונים ארבעה מקטעי קוד. איזה מקטעי הקוד הבאים חשוף למתקף Buffer Overflow? (התקבלו שתי תשובות)
על חברים אמרת2024
נתונים ארבעה מקטעי קוד. איזה מקטעי הקוד הבאים חשוף למתקף Buffer Overflow? (התקבלו שתי תשובות)
1
| done | ||
| done |
מיין לפי
מוניטין: 126
הסבר עבור קטע הקוד הראשון:
This C code is vulnerable to a Buffer Overflow attack because it uses the gets() function. The gets() function does not perform any boundary checks and can read an arbitrary amount of input, potentially overflowing the buffer (which is only 64 bytes). This can lead to a buffer overflow if the input exceeds the buffer's allocated size.
מוניטין: 126
עבור קטע הקוד הרביעי, אני לא כל כך בטוח מדוע זה פגיע אך זו התשובה של GPT:
Even though the code uses fgets(), which is much safer than gets(), the lecturer might have flagged this code segment because:
Caution with Boundaries: When using fgets(), it's good practice to leave room for the null terminator, but the final \0 check and truncation are handled in a somewhat redundant way here. This can sometimes cause confusion about whether or not the input is fully safe.
Potential Vulnerability in Later Code: The data collected in this function (in the log array) is passed into logMessage(). If that function doesn’t handle the input safely (for instance, by using gets()), it opens the possibility for a buffer overflow. Without seeing the full context of logMessage(), the code may be flagged as potentially risky.
מוניטין: 126
Input Limitation: If the input is exactly 127 characters (or more), fgets() will stop reading, and the input might be truncated. This may not cause an immediate buffer overflow but could lead to unexpected behavior. If the programmer expects that entire input strings will be read, this truncation might not be handled well elsewhere in the code.
מוניטין: 126
The Java code and Python code are not typically vulnerable to buffer overflow attacks because these languages handle memory management automatically and don't allow direct manipulation of memory like C does. Hence, they were not considered as answers.
* השאלה נוספה בתאריך: 26-09-2024