C Security & Hardening: Defeating Buffer Overflows, Format String Attacks & Memory Vulnerabilities

// VULNERABLE: classic textbook buffer overflow
void vulnerable_login(void) {
    char username[16];  // 16-byte stack buffer
    
    gets(username);  // NO BOUNDS CHECK — reads until newline
    // Input: "AAAAAAAAAAAAAAAA" * 4 + <return_address> 
    // Overwrites: return address → points to attacker shellcode
    
    printf("Welcome, %s\n", username);
}

// SECURE: bounds-limited input
void secure_login(void) {
    char username[64];
    
    if (!fgets(username, sizeof(username), stdin)) {
        return; // EOF or error
    }
    
    // Remove trailing newline
    username[strcspn(username, "\n")] = '\0';
    
    // Validate length
    if (strlen(username) == 0 || strlen(username) > 32) {
        fprintf(stderr, "Username must be 1-32 characters\n");
        return;
    }
    
    printf("Welcome, %s\n", username);
}

// VULNERABLE: heap overflow
int *buf = malloc(10 * sizeof(int)); // Allocate 10 integers
for (int i = 0; i <= 10; i++) {     // Bug: writes 11 items (one past end)
    buf[i] = i;                      // buf[10] overwrites glibc heap metadata
}
// After buf[10]: heap's internal "next free block" pointer is corrupted
// Next malloc/free call: undefined behavior, possible RCE via heap spray

// SECURE: strict bounds
int *buf = malloc(10 * sizeof(int));
if (!buf) return -1;
const int COUNT = 10;
for (int i = 0; i < COUNT; i++) {   // Strict < not <=
    buf[i] = i;
}
free(buf);

gcc -fsanitize=address -g vulnerable.c -o vulnerable
./vulnerable
# ASan output: heap-buffer-overflow on address 0x... at pc 0x...

// CRITICAL VULNERABILITY: user controls format string
void vulnerable_log(const char *user_message) {
    printf(user_message);  // If user inputs "%x %x %x %n":
    // %x %x %x: READ from stack (information disclosure)
    // %n:       WRITE the count of printed chars to the next pointer on stack
    //           → arbitrary write to arbitrary address
}

// ATTACK INPUT: "%08x %08x %08x %n"
// Reads: stack addresses, heap addresses (information disclosure)
// Writes: can overwrite function's GOT entry → execute shellcode

// SECURE: ALWAYS use %s for strings
void secure_log(const char *user_message) {
    printf("%s", user_message);      // user_message treated as data, not format
    fprintf(stderr, "%s\n", user_message); // Same for stderr
    syslog(LOG_INFO, "%s", user_message);  // Same for syslog
}

#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>

// VULNERABLE: allocation size overflow
void vulnerable_alloc(size_t width, size_t height) {
    // If width = 65537, height = 65537 on 32-bit:
    // width * height = 65537 * 65537 = 4,295,098,369
    // Truncated to uint32_t: 65,537 (far too small!)
    size_t size = width * height * sizeof(uint32_t); // OVERFLOW!
    uint32_t *pixels = malloc(size);                 // malloc(tiny_value)
    pixels[width * height - 1] = 0;                  // HEAP OVERFLOW
}

// SECURE: check before multiplying
int safe_alloc(size_t width, size_t height, uint32_t **out) {
    // Check: would width * height overflow size_t?
    if (width > 0 && height > SIZE_MAX / width) {
        return -1; // Would overflow
    }
    size_t count = width * height;
    
    if (count > SIZE_MAX / sizeof(uint32_t)) {
        return -1; // Multiplication with sizeof would overflow
    }
    
    *out = malloc(count * sizeof(uint32_t));
    return *out ? 0 : -1;
}

// C23 approach: use __builtin_mul_overflow (GCC/Clang)
bool safe_multiply(size_t a, size_t b, size_t *result) {
    return !__builtin_mul_overflow(a, b, result); // true if no overflow
}

#include <stdlib.h>
#include <stdio.h>

// VULNERABLE: use-after-free
void vulnerable_pattern(void) {
    int *p = malloc(sizeof(int));
    *p = 42;
    free(p);
    
    // Bug: p still contains the old address (now freed)
    printf("%d\n", *p);  // Use-after-free — undefined behavior
    *p = 99;              // WRITE to freed memory
    // If malloc re-allocates this block, writing 99 corrupts new object's data
}

// SECURE: null after free, RAII pattern
void secure_pattern(void) {
    int *p = malloc(sizeof(int));
    if (!p) return;
    *p = 42;
    free(p);
    p = NULL; // Immediately null the pointer after free
    
    if (p) {  // This check now protects against use-after-free
        printf("%d\n", *p);
    }
}

// Better: wrapper macro
#define SAFE_FREE(ptr) do { free(ptr); (ptr) = NULL; } while (0)

# Check what mitigations your binary has on Linux:
checksec --file=./your_binary

# Typical output:
# Stack Canary  : ENABLED  → Detects stack overflows before ret
# NX            : ENABLED  → Stack/heap marked non-executable (no shellcode)
# PIE           : ENABLED  → Position-independent; enables ASLR
# ASLR          : ENABLED  → Randomize stack/heap/library addresses
# RELRO         : FULL     → GOT table read-only after init

# Recommended production build flags
gcc -O2 -Wall -Wextra -Wpedantic           \
    -fstack-protector-strong               \  # Stack canaries
    -D_FORTIFY_SOURCE=3                    \  # Runtime bound checking on libc calls
    -fpie -pie                             \  # Enable ASLR
    -Wl,-z,relro,-z,now                    \  # Full RELRO
    -Wl,-z,noexecstack                     \  # NX stack
    -fstack-clash-protection               \  # Stack clash defense
    -fcf-protection=full                   \  # Control flow integrity (Intel CET)
    main.c -o program

# Debug/testing flags (never in production release)
gcc -g -fsanitize=address,undefined,leak   \  # ASan + UBSan + LeakSanitizer
    -fsanitize=thread                      \  # + ThreadSanitizer (not with ASan)
    main.c -o program_debug

# Static analysis
cppcheck --enable=all main.c               # Static analysis
clang --analyze main.c                     # Clang analyzer
scan-build gcc main.c                      # Clang scan-build

# AddressSanitizer (ASan) — fast, finds most memory errors
gcc -fsanitize=address,undefined -g program.c -o program_asan
./program_asan
# Catches: heap/stack buffer overflow, use-after-free, double-free,
#          use-after-return, invalid free, memory leaks

# Valgrind memcheck — slower but comprehensive
gcc -g program.c -o program_debug
valgrind --tool=memcheck --leak-check=full --track-origins=yes ./program_debug

# libFuzzer — automated security testing (finds inputs that crash your code)
gcc -fsanitize=address,fuzzer program.c -o fuzz_target
./fuzz_target corpus_dir/  # Generates random inputs, tracks crashes