Question

Heaps, Stacks, Queues, and Buffers The study materials covered a range of characteristics that make up heaps, stacks, queues, and buffers, and some of the potential vulnerabilities that can result from improper coding of applications and operating systems. Discuss the features of these data structures and specific ways that they can create vulnerabilities if not handled properly. Include in the discussion strategies for secure coding procedures that will reduce the risk to information assets that can be caused by improper handling of these aspects of an application of operating system. Response Guidelines Read the posts of your peers, and respond to a minimum of two. Expand on the concepts covered in their initial posts. The quantity and quality of your posts will determine the value of the group's learning experience.

Answer 1

1. Buffer:- A buffer is a temporary area for data storage. When more data (than was originally allocated to be stored) gets placed by a program or system process, the extra data overflows. It causes some of that data to leak out into other buffers, which can corrupt or overwrite whatever data they were holding.

Vulnerability issues due to improper coding:-

Let us study some real program examples that show the danger of such situations based on the C.
In the examples, we do not implement any malicious code injection but just to show that the buffer can be overflow. Modern compilers normally provide overflow checking option during the compile/link time but during the run time it is quite difficult to check this problem without any extra protection mechanism such as using exception handling.

// A C program to demonstrate buffer overflow #include <stdio.h> #include <string.h> #include <stdlib.h> int main(int argc, char *argv[]) {        // Reserve 5 byte of buffer plus the terminating NULL.        // should allocate 8 bytes = 2 double words,        // To overflow, need more than 8 bytes...        char buffer[5]; // If more than 8 characters input                         // by user, there will be access                         // violation, segmentation fault        // a prompt how to execute the program...        if (argc < 2)        {               printf("strcpy() NOT executed....\n");               printf("Syntax: %s <characters>\n", argv[0]);               exit(0);        }        // copy the user input to mybuffer, without any        // bound checking a secure version is srtcpy_s()        strcpy(buffer, argv[1]);        printf("buffer content= %s\n", buffer);        // you may want to try strcpy_s()        printf("strcpy() executed...\n");        return 0; } Explaination:- The vulnerability exists because the buffer could be overflowed if the user input (argv[1]) bigger than 8 bytes. Why 8 bytes? For 32 bit (4 bytes) system, we must fill up a double word (32 bits) memory. Character (char) size is 1 byte, so if we request buffer with 5 bytes, the system will allocate 2 double words (8 bytes). That is why when you input more than 8 bytes; the mybuffer will be over flowed. C/C++ coder or programmer must know the buffer overflow problem before they do the coding. A lot of bugs generated, in most cases can be exploited as a result of buffer overflow.

Heaps:- Heap is a special case of balanced binary tree data structure where the root-node key is compared with its children and arranged accordingly. If ? has child node ? then ?

key(?) ? key(?)

As the value of parent is greater than that of child, this property generates Max Heap. Based on this criteria, a heap can be of two types ?

For Input ? 35 33 42 10 14 19 27 44 26 31

Min-Heap ? Where the value of the root node is less than or equal to either of its children.

10 14 19 26 31 42 27 35

Max-Heap ? Where the value of the root node is greater than or equal to either of its children.

35 42 31 19 27 10 26 14

Both trees are constructed using the same input and order of arrival.

Vulnerability issues due to improper coding:-

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Example 1:- While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:

(bad code)

Example Language: C

#define BUFSIZE 256
int main(int argc, char **argv) {

char *buf;
buf = (char *)malloc(sizeof(char)*BUFSIZE);
strcpy(buf, argv[1]);

}

The buffer is allocated heap memory with a fixed size, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow.

Example 2:- This example applies an encoding procedure to an input string and stores it into a buffer.

(bad code)

Example Language: C

char * copy_input(char *user_supplied_string){int i, dst_index;
char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);
if ( MAX_SIZE <= strlen(user_supplied_string) ){

die("user string too long, die evil hacker!");

}
dst_index = 0;
for ( i = 0; i < strlen(user_supplied_string); i++ ){if( '&' == user_supplied_string[i] ){

dst_buf[dst_index++] = '&';
dst_buf[dst_index++] = 'a';
dst_buf[dst_index++] = 'm';
dst_buf[dst_index++] = 'p';
dst_buf[dst_index++] = ';';

}
else if ('<' == user_supplied_string[i] ){

/* encode to &lt; */

}
else dst_buf[dst_index++] = user_supplied_string[i];}
return dst_buf;}

The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.

Stacks:- Stack is an abstract data type with a bounded(predefined) capacity. It is a simple data structure that allows adding and removing elements in a particular order. Every time an element is added, it goes on the top of the stack and the only element that can be removed is the element that is at the top of the stack, just like a pile of objects.

Basic features of Stack:-

1. Stack is an ordered list of similar data type.
2. Stack is a LIFO(Last in First out) structure or we can say FILO(First in Last out).
3. push() function is used to insert new elements into the Stack and pop() function is used to remove an element from the stack. Both insertion and removal are allowed at only one end of Stack called Top.
4. Stack is said to be in Overflow state when it is completely full and is said to be in Underflow state if it is completely empty.

Vulnerability issues due to improper coding:-

Stack Overflow:- Handling a stack overflow is not the right solution, instead, you must ensure that your program does not overflow the stack. Do not allocate large variables on the stack (where what is "large" depends on the program). Ensure that any recursive algorithm terminates after a known maximum depth. If a recursive algorithm may recurse an unknown number of times or a large number of times, either manage the recursion yourself (by maintaining your own dynamically allocated stack) or transform the recursive algorithm into an equivalent iterative algorithm. A program that must be "really robust" will not use third-party or external libraries that "eat a lot of stack."

Queues:- Queue is a linear structure which follows a particular order in which the operations are performed. The order is First In First Out (FIFO).

Operations on Queue:
Mainly the following four basic operations are performed on queue:

Enqueue: Adds an item to the queue. If the queue is full, then it is said to be an Overflow condition.
Dequeue: Removes an item from the queue. The items are popped in the same order in which they are pushed. If the queue is empty, then it is said to be an Underflow condition.
Front: Get the front item from queue.
Rear: Get the last item from queue.

Queue Insertion and Deletion happen on different ends Rear Front Degueue Enqueue First in first out

Vulnerability issues due to improper coding:-

As a process enters a system, they are put into a job queue. This queue consists of all jobs in the system. The processes that are residing in main memory and are ready & waiting to execute are kept on a list called ready queue. The list of processes waiting for a particular I/O device is kept in the device queue. If these queues are not properly maintained then the process may not get a chance to enter the CPU for execution, or it may so happen that the process first to enter the queue, is the last to exit from it thus increasing the waiting time of that particular process.

Please let me know in case of any clarifications required. Thanks!