Question

Examine the line management routines in this dir. It handles any number
of lines (or queues), and returns a pointer to the line that is created.
The header file (queueHeader.h), the line manager (queueManager.c) and a
'skeleton' driver program, lineMain.c, are given.

Item 1 lineMain.c:
Extend/expand lineMain.c so the expanded code exercises/invokes the various line management functions.
The driver program should hep convince the reader that you understand these functions or routines!
The driver should have comments @ top that explains what this program (along with its line management routines)
does, and an explanation of its functions. Please mark this comment as 'Explanation of
this Program and its Functions.'
Note that you do NOT modify the files: queueHeader.h, queueManager.c

Item 2 [add, as comment, at top of lineMain.c, mark the comment as ITEM 2 - 4 Vulnerabilities]:

Analyze the given code given and explain clearly any four vulnerabilities, each
description of about 5 or 6 sentences. Each vulnerability has to be a
very specific problem, not something general like buffer overflow etc.

Item 3 lineExploit.c:
For any ONE vulnerability, write an exploit, mainExploit.c;
exploit code should be readable and well-documented, else you get 0.
lineExploit.c should have comments @ top that describes the vulnerability you are exploiting and how your exploit
exposes the vulnerability. Note that just crashing the program is NOT an exploit.
Note that you do NOT modify the files: queueHeader.h, queueManager.c

Item 4 [add, as comment, at top of lineMain.c, mark the comment as ITEM 4 - ONE Vulnerability possible fix]:
For any ONE of the remaining vulnerabilities, state the vulnerability, and describe how you would fix it; however, NO need
to provide the code for actual fix.

Machine to work on:
   PC, Mac or unix (you make the call). May use DeterLab or any other computer.

Submit ONE snapshot file (like Homework 3 or 4) on Canvas.
This snapshot file includes the items below: Do NOT use backspace during the snapshot else you will be docked
  
Items 1 & 2: Complete source code listing of lineMain.c, and compile/run w/o any exploit.
Run it a couple of times to make sure the functions are exercised.

Items 3 & 4: Complete source code listing of lineExploit.c, and compile/run of the exploit to show that
the exploit works.
  
  

//lineMain.c   

#include <stdio.h>
#include <stdlib.h>
#include <math.h>
#include <time.h>
#include "queueManager.c"

int main(int argc, const char * argv[]) {

}
-------------
//queueHeader.h

/*
* line Manager Header file
*/

/*
* the queue structure
*/
typedef struct queue {
   int *que;       /* the actual array of queue elements */
   int head;       /* head index in que of the queue */
   int count;       /* number of elements in queue */
   int size;       /* max number of elements in queue */
} QUEUE;

/*
* the library functions
*/
void queueManage(QUEUE **, int, int);   /* create or delete a queue */
void addToQueue(QUEUE *, int);   /* add to queue */
void removeFromQueue(QUEUE *, int *);   /* remove from queue */

---------------
//queueManager.c

/*
* line Manager
*/
#include <stdio.h>
#include <stdlib.h>
#include "queueHeader.h"

/*
* create or delete a queue
*
* PARAMETERS:   QUEUE **qptr   space for, or pointer to, queue
*        int flag   1 for create, 0 for delete
*       int size   max elements in queue
*/
void queueManage(QUEUE **qptr, int flag, int size)
{
   if (flag){
       /* allocate a new queue */
       *qptr = malloc(sizeof(QUEUE));
       (*qptr)->head = (*qptr)->count = 0;
       (*qptr)->que = malloc(size * sizeof(int));
       (*qptr)->size = size;
   }
   else{
       /* delete the current queue */
       (void) free((*qptr)->que);
       (void) free(*qptr);
   }
}

/*
* add an element to an existing queue
*
* PARAMETERS:   QUEUE *qptr   pointer for queue involved
*       int n       element to be appended
*/
void addToQueue(QUEUE *qptr, int n)
{
   /* add new element to tail of queue */
   qptr->que[(qptr->head + qptr->count) % qptr->size] = n;
   qptr->count++;

}

/*
* take an element off the front of an existing queue
*
* PARAMETERS:   QUEUE *qptr   pointer for queue involved
*       int *n       storage for the return element
*/
void removeFromQueue(QUEUE *qptr, int *n)
{
   /* return the element at the head of the queue */
   *n = qptr->que[qptr->head++];
   qptr->count--;
   qptr->head %= qptr->size;
}

  

Answer 1

I added a comment of vulnerabilities in the code. and make a normal program as lineMain.c  please go through code and output.

Message me if you have any querry.

#include <stdio.h>
#include <stdlib.h>
#include <math.h>
#include <time.h>
#include "queueManager.c" /* Here is vulnerability we should not include c file link this*/
/* instad of this we need to make header file or compile whole c files using makefile or gcc command. */

int main(int argc, const char * argv[]) {
QUEUE *qptr = NULL;
int choice;
int data;
queueManage(&qptr,1,10);

while(1) /* rotate loop infinit time so that user can take action */
{
printf("1. Add in queue\n2. Remove from queue\n3. Quit\n"); /* Take choice from user */
scanf("%d",&choice);

if(choice == 1) /* Take action according to user intput*/
{
printf("Enter value : "); /* take data from user for add or remove from queue */
scanf("%d",&data);
addToQueue(qptr, data); /* Add in queue */
}
else if(choice == 2)
{
removeFromQueue(qptr, &data); /* dequeue */
printf("dequeue - %d \n",data);
}
else
{
break; /* If user enters any other option break the while loop and come out from the program */
}

}

}

- There is another vulnerability is in dequeue function. we should print queue is empty instead of fill 0.

- Also, we need to give an error when the queue will full.  

- We need to create Makefile instead of adding c file in lineMain.c

or compile using `gcc lineMain.c queueManager.c`.

I added fix in lineExploit.c

#include <stdio.h>
#include <stdlib.h>
#include <math.h>
#include <time.h>
#include "queueHeader.h" /*instad of adding queueManager.c we need to add queueHeader.h file */

int main(int argc, const char * argv[]) {
QUEUE *qptr = NULL;
int choice;
int data;
queueManage(&qptr,1,10);

while(1) /* rotate loop infinit time so that user can take action */
{
printf("1. Add in queue\n2. Remove from queue\n3. Quit\n"); /* Take choice from user */
scanf("%d",&choice);

if(choice == 1) /* Take action according to user intput*/
{
printf("Enter value : "); /* take data from user for add or remove from queue */
scanf("%d",&data);
addToQueue(qptr, data); /* Add in queue */
}
else if(choice == 2)
{
removeFromQueue(qptr, &data); /* dequeue */
printf("dequeue - %d \n",data);
}
else
{
break; /* If user enters any other option break the while loop and come out from the program */
}

}

}