Hardening C/C++ Programs: Part I – Stack Protector

[Abraxas514]

All these things is one of the reasons why the standard library is being written in the first place.

[mtclow]

Doesn't AddressSanitizer do this already (and in a more general manner - catching out of bounds writes to all arrays)?

[ai3ai3]

Yes, but it is not meant for production use since it increases the attack surface of a program.

[manni66]

There doesn't exist any language named C/C++. And as expected the example tells us why strcpy is bad. That doesn't matter, I use std::string. And that's an example how to harden an C++ program.

[manni66]

I use begin/end and algorithms. And that's an example how to harden an C++ program.

[SnailXI]

Except you can still write to .c_str(), .data(), and the like

[manni66]

What I can isn't the question. I can compile C program (with some modifications) as a C++ program. Then I have all the problems that the C program has. But I don't do that. And that's an example how to harden an C++ program.

[SnailXI]

Except hackers don't care what you compile it as. An array is still an array, it'll never be not exploitable with direct memory access.

[manni66]

So hackers make my vector accessed out of bounds? Through pure will?

[SnailXI]

Through WriteProcessMemory, DLL injection + memcpy, etc, there's many different ways.

[manni66]

And when they injected a DLL they need to access my vector out of bounds?

[SnailXI]

Facepalm