Secure Programming Practices in C++ (NDC Oslo 2018)

Secure Programming
Practices in C++
@pati_gallardo Patricia Aas
NDC { Oslo } 2018

Patricia Aas - Vivaldi Browser
Programmer - mainly in C++
Currently : Vivaldi Technologies
Previously : Cisco Systems, Knowit, Opera Software
Master in Computer Science
Twitter : @pati_gallardo
Photos: pixabay.com - CC0

Bjarne Stroustrup
“C makes it easy to shoot yourself in the
foot; C++ makes it harder, but when you do
it blows your whole leg off.”
@pati_gallardo

Bjarne Stroustrup
“Within C++, there is a much smaller and
cleaner language struggling to get out.”
@pati_gallardo

What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo

What specs exist?
@pati_gallardo

CG: C++ Core Guidelines (328 pages!)
@pati_gallardo

C++ Core Guidelines
“The C++ Core Guidelines are a collaborative effort led by
Bjarne Stroustrup, much like the C++ language itself.”
https://github.com/isocpp/CppCoreGuidelines/blob/master/README.md
@pati_gallardo

@pati_gallardo
SEI: CERT C++ Coding Standard (435 pages!)

SEI CERT C Coding Standard
“The SEI CERT C [and C++] Coding Standard is a software coding
standard for the C [and C++] programming language, developed
by the CERT Coordination Center to improve the safety,
reliability, and security of software systems.”
https://en.wikipedia.org/wiki/CERT_C_Coding_Standard
@pati_gallardo

CWE : Common Weakness Enumeration (1572 pages!)
@pati_gallardo

Common Weakness Enumeration (CWE)
“The Common Weakness Enumeration (CWE) is a category system
for software weaknesses and vulnerabilities. It is sustained
by a community project with the goals of understanding flaws
in software and creating automated tools that can be used to
identify, fix, and prevent those flaws.”
https://en.wikipedia.org/wiki/Common_Weakness_Enumeration
@pati_gallardo

@pati_gallardo
Undefined Behaviour

undefined behavior
“Examples of undefined behavior are memory accesses outside of array bounds, signed
integer overflow, null pointer dereference, modification of the same scalar more than
once in an expression without sequence points, access to an object through a pointer of a
different type, etc. Compilers are not required to diagnose undefined behavior (although
many simple situations are diagnosed), and the compiled program is not required to do
anything meaningful.”
http://en.cppreference.com/w/cpp/language/ub
@pati_gallardo

- Don’t reason about undefined
behaviour
- Assume that it crashes or is
never executed
- Changing compiler, compiler
version or optimization level
can break your application
Undefined Behaviour

Infinite Loop (Undefined Behavior)
#include <iostream>
#include <complex>
using namespace std;
int main(void) {
complex<int> delta;
complex<int> mc[4] = {0};
for(int di = 0; di < 4; di++, delta = mc[di]) {
cout << di << endl;
}
}
@pati_gallardo
(Thanks to @shafikyaghmour) https://stackoverflow.com/questions/32506643/c-compilation-bug
Undefined
Behavior!

Infinite Loop (Undefined Behavior)
Should we Godbolt this?
https://godbolt.org/g/TDjM8h
@pati_gallardo
(Thanks to @shafikyaghmour) https://stackoverflow.com/questions/32506643/c-compilation-bug

@pati_gallardo Compiler Optimization

@pati_gallardo
The Case Of The Disappearing Memset

0) CWE-14: Compiler Removal of Code to Clear Buffers
void GetData(char *MFAddr) {
char pwd[64];
if (GetPasswordFromUser(pwd, sizeof(pwd))) {
if (ConnectToMainframe(MFAddr, pwd)) {
// Interaction with mainframe
}
}
memset(pwd, 0, sizeof(pwd)); // <- Removed by the optimizer
}
@pati_gallardo
SEI: MSC06-C. Beware of compiler optimizations
SEI: MEM03-C. Clear sensitive information stored in reusable resources

0) CWE-14: Compiler Removal of Code to Clear Buffers
Should we Godbolt this?
https://godbolt.org/g/FpEsht
@pati_gallardo

Memset_s : Zeroing Memory
// Compliant Solution (C11)
memset_s(pwd, 0, sizeof(pwd));
// Windows Solution
SecureZeroMemory(pwd, sizeof(pwd));
@pati_gallardo

1. Unsigned Integer Wraparound
2. Signed Integer Overflow
3. Numeric Truncation
4. Stack Buffer Overflow
5. Heap Buffer Overflow
6. Buffer Underflow
7. Use After Free
8. Double Free
9. Incorrect Type Conversion
10. Uncontrolled Format String
@pati_gallardo

Code is on GitHub:
https://github.com/patricia-gallardo/insecure-coding-examples
Disclaimer:
The concat buffer examples aren’t really fair because if you
did concatenation of strings in this way you would have to
take into consideration 0 termination of strings and that
doesn’t fit on a slide, so... sigh
@pati_gallardo

1) Unsigned Integer Wraparound
2) Signed Integer Overflow
3) Numeric Truncation Error

1) CWE-190: Unsigned Integer Wraparound
int main(void) {
unsigned int first_len = UINT_MAX;
unsigned int second_len = 256;
unsigned int buf_len = 256;
char first[first_len], second[second_len], buf[buf_len];
if((first_len + second_len) <= 256) { // <- sum == 255
memcpy(buf, first, first_len);
memcpy(buf + first_len, second, second_len);
}
}
@pati_gallardo
SEI-INT30-C. Ensure that unsigned integer operations do not wrap

2) CWE-190: Signed Integer Overflow
int main(void) {
int first_len = INT_MAX;
int second_len = 256;
int buf_len = 256;
if((first_len + second_len) <= 256) { // <- UB (negative)
}
}
@pati_gallardo
SEI-INT32-C. Ensure that operations on signed integers do not result in

3) CWE-197: Numeric Truncation Error
int main(void) {
unsigned int first_len = UINT_MAX - 256;
unsigned int second_len = 256;
unsigned int buf_len = 256;
int new_len = (first_len+second_len); // <- IDB (negative)
if(new_len <= 256) {
}
}
@pati_gallardo
SEI-INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data

4) Stack-based Buffer Overflow
5) Heap-based Buffer Overflow
6) Buffer Underwrite/Underflow

4) CWE-121: Stack-based Buffer Overflow
@pati_gallardo
int main(void) {
char buffer[10];
// CWE-242 : Inherently Dangerous Function
gets(buffer); // <- Write outside
}
SEI-STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator

5) CWE-122: Heap-based Buffer Overflow
int main(int argc, char * argv[]) {
char* buf = (char*) malloc(sizeof(char)*10);
strcpy(buf, argv[1]); // <- Write outside
free(buf);
}
@pati_gallardo
SEI-ARR38-C. Guarantee that library functions do not form invalid pointers

6) CWE-124: Buffer Underwrite / Underflow
int main(void) {
char src[12];
strcpy(src, "Hello World");
size_t length = strlen(src);
int index = (length -1);
while (src[index] != ':') {
src[index] = '0';
index--;
}
}
@pati_gallardo
SEI-ARR30-C. Do not form or use out-of-bounds pointers or array subscripts

7) Use After Free
8) Double Free

7) CWE-416: Use After Free
@pati_gallardo
int main(void) {
char* buffer = (char*)malloc (256);
bool error = true;
if (error)
free(buffer);
// [...]
if (error)
printf("%lun", strlen(buffer)); //<- Use after free
}
SEI-MEM30-C. Do not access freed memory

8) CWE-415: Double Free
@pati_gallardo
int main(void) {
char* buffer = (char*)malloc (256);
bool error = true;
if (error)
free(buffer);
// [...]
free(buffer); // second free
}
SEI-MEM51-CPP. Properly deallocate dynamically allocated resources

9) Incorrect Type Conversion/Cast
10) Use of External Format String

9) CWE-704: Incorrect Type Conversion/Cast
@pati_gallardo
struct A {};
struct B {};
int main(void) {
struct A * a = (struct A *) malloc (sizeof (struct A));
struct B * b = (struct B *) a; // cast to unrelated type
}
SEI-EXP05-CPP. Do not use C-style casts

10) CWE-134: Use of External Format String
@pati_gallardo
char * format = argv[1];
char * str = argv[2];
printf(format, str);
}
$ ./format_string "%s %d" "Hello World"
Hello World 1745066888
SEI-FIO47-C. Use valid format strings

Classes of Tools
- Several compilers
- Warnings / Errors
- Instrumentation
- Static Analysis
- Automated Tests
- Fuzzing
- Continuous Integration
- Libraries
@pati_gallardo

The Eight I'd Really Rather You Didn'ts*
*The Eight Condiments (Pastafarianism)
@pati_gallardo

Caution: Don’t take me too
seriously. But seriously, think
about it! *wink*
@pati_gallardo

The Eight I'd Really
Rather You Didn'ts
1. Use C
2. Allocate with new
3. Do math a lot
4. Trust your external input
5. Use pointers a lot
6. Write “clever” code
7. Use shared_ptr a lot
8. Use share state a lot
@pati_gallardo

1. I'd Really Rather You Didn't:
Use C
@pati_gallardo
CG : CPL.1: Prefer C++ to C

Std::string - Concatenate Strings
int main() {
std::string first = "Hello ";
std::string second = "World";
std::string buffer = first + second;
std::cout << buffer << "n";
}
@pati_gallardo

Std::cout/cin : Using the Command Line
std::string second;
std::cin >> second;
std::string first = argv[1];
std::string buffer = first + second;
std::cout << buffer << "n";
}
$ ./command_line "Hello "
World
Hello World
@pati_gallardo

Algorithms : Strip after Colon
int main() {
string str = "Hello:World";
auto isColon = [](int ch) { return ch == ':'; };
auto first = find_if(rbegin(str), rend(str), isColon);
str.erase(first.base(), end(str));
}
@pati_gallardo

C++ Casts : Safe Downcasting
class Spiderman {};
class Ironman {};
int main() {
Spiderman * peter = new Spiderman;
Ironman * tony = static_cast<Ironman*>(peter);
}
inheritance.cpp:6:20: error: static_cast from 'Spiderman *'
to 'Ironman *', which are not related by inheritance, is not allowed
Ironman * tony = static_cast<Ironman*>(peter);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
@pati_gallardo

@pati_gallardo
CG : R: Resource management
CG : R.11: Avoid calling new
and delete explicitly
Allocate With New

Allocating on the Stack
#include "Hero.h"
int main()
{
Hero h;
}
@pati_gallardo

Where is it?
Stack
Hero stackHero;
Heap
unique_ptr<Hero> heapHero =
make_unique<Hero>();
Hero * heapHero = new Hero();
@pati_gallardo

Loving the Stack
#include <iostream>
#include <string>
int main()
{
{
string s("Hello World!");
cout << s;
} // <- GC happens here!
}
@pati_gallardo

Using the Stack To Manage Resource Lifetimes
Destroyed when exiting scope
Deterministic Garbage Collection
@pati_gallardo

Hold a Value on the Stack that
Controls The Lifetime of Your Heap
Allocated Object
{
unique_ptr<Hero> myHero =
make_unique<Hero>();
shared_ptr<Hero> ourHero =
make_shared<Hero>();
}
Smart Pointers
@pati_gallardo

@pati_gallardo
Do Math A Lot

Primitive types have no semantics, only limits
Reduce the value space
Keep it within defined behavior
Enum class, string literals, user defined
literals, size_t
@pati_gallardo

Enum Class
@pati_gallardo
enum class Direction : char
{ NORTH = 'N', EAST = 'E', WEST = 'W', SOUTH = 'S' };
std::ostream& operator << (std::ostream& os, const Direction& obj) {
os << static_cast<std::underlying_type<Direction>::type>(obj);
return os;
}
int main() {
std::cout << "t" << Direction::NORTH << "n"
<< "t" << Direction::EAST << "n"
<< "t" << Direction::WEST << "n"
<< "t" << Direction::SOUTH << "n";
}

String Literals
@pati_gallardo
using namespace std::literals::string_literals;
int main() {
auto heroes = {"Spiderman"s, "Ironman"s, "Wonder Woman"s};
for(auto const & hero : heroes) {
std::cout << "t" << hero << "n";
}
}

1) User Defined Literals
@pati_gallardo
int main() {
auto h = 24_hours;
auto d = 7_days;
auto err = h + d;
}
user_defined_literals.cpp:25:21: error: invalid operands to
binary expression ('Hours' and 'Days')
auto err = hours + days;
~~~~~ ^ ~~~~
1 error generated.

@pati_gallardo
struct Hours {
explicit Hours(unsigned long long n) : num(n) {}
unsigned long long num = 0;
};
struct Days {
explicit Days(unsigned long long n) : num(n) {}
unsigned long long num = 0;
};

@pati_gallardo
Hours operator "" _hours(unsigned long long num) {
return Hours(num);
}
Days operator "" _days(unsigned long long num) {
return Days(num);
}

Use Size_t for Sizes
- Unsigned integer type
- Result of the sizeof
operator
- Use for object sizes
- Use for array indexing and
loop counting
@pati_gallardo

@pati_gallardo
Trust Your External Input

Taint
- Is the source of this value
in your code?
- Command line args, size
fields in headers, exported
functions, APIs
@pati_gallardo

Use Pointers a Lot
@pati_gallardo

@pati_gallardo
Write “clever” code

Use shared_ptr a Lot
@pati_gallardo

Share State a Lot
@pati_gallardo

So… what should I remember from this
presentation?
@pati_gallardo

Well, I'd Really Rather You Didn't:
Use C
@pati_gallardo

Learn some Modern C++ Instead!
@pati_gallardo

Secure Programming Practices in C++ (NDC Oslo 2018)

More Related Content

What's hot (20)

Similar to Secure Programming Practices in C++ (NDC Oslo 2018) (20)

More from Patricia Aas (20)

Recently uploaded (20)

Secure Programming Practices in C++ (NDC Oslo 2018)