Question

Provide an original example of a security flaw or vulnerability related to pointers. The original source should be cited but not copied directly.

Answer 1

NULL pointer dereference erros are common in C/C++ languages. Pointer is a programming language data type that references a location in memory. Once the value of the location is obtained by the pointer, this pointer is considered dereferenced. The NULL pointer dereference weakness occurs where application dereferences a pointer that is expected to be a valid address but instead is equal to NULL. The following C++ example causes a NULL pointer dereference error:

1. #include <stdio.h>

2. int *ptr = NULL;

3. int _tmain(int argc, _TINT* argv[])

4. {

5.   *ptr = 17;

6.   return 0;

7. }

The following C++ code demonstrates NULL pointer dereference error within the getaddrinfo() function when argv[2] is empty:

1. #undef UNICODE

2. #include "StdAfx.h"

3. #include <winsock2.h>

4. #include <ws2tcpip.h>

5. #include <stdio.h>

6. #pragma comment (lib, "Ws2_32.lib")

7. int __cdecl main(int argc, char **argv)

8. {

9. WSADATA wsaData;

10.   int iResult;

11. INT iRetval;

12. DWORD dwRetval;

13.   int i = 1;

14.   struct addrinfo *result = NULL;

15.   struct addrinfo *ptr = NULL;

16.   struct addrinfo hints;

17.   if(argc<2){

18.   printf("usage: %s <proto> <hostname> <servicename>\n", argv[0]);

19.   return 1;

20.   }

21. iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);

22.   if (iResult != 0) {

23.   printf("WSAStartup failed: %d\n", iResult);

24.   return 1;

25.   }

26. ZeroMemory( &hints, sizeof(hints) );

27. hints.ai_family = AF_UNSPEC;

28. hints.ai_socktype = SOCK_STREAM;

29. hints.ai_protocol = IPPROTO_TCP;

30. dwRetval = getaddrinfo(argv[2], argv[3], &hints, &result);

31.   if ( dwRetval != 0 ) {

32.   printf("getaddrinfo failed with error: %d\n", dwRetval);

33. WSACleanup();

34.   return 1;

35.   }

36.   printf("getaddrinfo returned success\n");

37.   return 0;

38. }

The above code contains a logic error when checking against the number of input parameters in the if(argc<2) statement. As a result, NULL is passed as the first argument of the getaddrinfo() function instead of a valid address.

A number of flaws can cause NULL pointer dereference issues, including race condition, and programming omissions as demonstrated above.

Potential impact

In most cases, NULL pointer dereference errors result in the crash of application however, code execution is possible under certain circumstances. Depending on privileges of the application, this weakness can result in a denial of service attack against the entire system or can be used to gain complete control over it.