Subject: How to create more secure programs

From: "ik_5" <[email-masked]>
Date: Sun, 10 Apr 2005 07:43:30 -0000

Hi all,

Most of the times I only read the posts on the mailing-list, and now I
wish also to start a new subject :)

I finally finished writing the first version of *Secure
Programming* under Free-Pascal wiki pages:
http://www.freepascal.org/wiki/index.php/Secure_programming

And while I mostly using the Pascal language to give examples, this
document in my opinion can contribute to anyone.

One note please: The Buffer Overflow example I made on the wiki page
is not a real buffer overflow, because it never arrive into the stack
(It seems that the compiler handle the memory on it's own even on
&#8220;buffers&#8221;) but still it's the closest thing I was able to
find that is
close to a real buffer overflow in Pascal :) 

Please read the entire paper and tell me what you think,

Ido

---

From: Shlomi Fish <[email-masked]>
Date: Sun, 10 Apr 2005 14:01:24 +0300

> http://www.freepascal.org/wiki/index.php/Secure_programming

<<<
var

  iNums : array [0..9]  of integer;

  ....

  FillChar (iNums[-1], 100, #0);
  ....

  for i := -10 to 10 do

     readln (iNums[i]);

  ....

Your array is allocated from 0 to 9, yet you fill it from -10 to 10. So the 
example is unclear.

<<<
 (g flag instruct Perl to continue the search from the position it stopped. i 
is for insensitive case).

Actually in the case of the s/// statement, it instructs perl to substitute 
globally (i.e: all occurences).

<<<
 there are many issues that I did touched them in this document. P

Should be "I did not touch".

Regards,

	Shlomi Fish

> Yahoo! Groups Links

-- 

---------------------------------------------------------------------
Shlomi Fish      [email-masked]
Homepage:        http://www.shlomifish.org/

Hacker sees bug. Hacker fixes bug.

---

From: "ik_5" <[email-masked]>
Date: Sun, 10 Apr 2005 11:46:02 -0000

> Your array is allocated from 0 to 9, yet you fill it from -10 to 10.
So the 
Well I'm attempting to show what is a buffer overflow by going into
undecleared range and attempt to access them... The problem with this
example is that the compiler will warn you about it, or block you from
continue compiling if you have a compiler directive of range check.

But if I would have used variables for position it would pass.

An example of Open Array (the original example) was removed by me
after some core developers of FPC told me that the only way I may be
possible (alto will not be...) is to use static arrays...

> Should be "I did not touch".

Thanks for the comments, I fixed the page.

Ido

> Shlomi Fish      shlomif@i...