...
(Section under construction by Ciera. Just wanted to get some current notes down here before I clean it up.)
Static Analysis
A local analysis should work fine here. We will assume that all byte string parameters to a method are required to be null terminated and are guaranteed to be null terminated after the function.
In the case where it is not required or not guaranteed, we will have to create a separate specification. Given that this is C, the best option might be two hardcoded handling routines in the analysis. If the function either accepts an open string (not null terminated) or can return an open string, we can write some code to specify this. The analysis calls these handling routines to retrieve these specifications.
Another option would be to utilize the preprocessor. However, I don't think that is in the style of C programmers. Additionally, we can't add these specs to libraries that way. Given the environment, a separate specification, in C, is probably the best option.
We also need to assume that there is a string length analysis.
Once we have this information, we can do a local flow analysis. The lattice has 4 elements, bottom, NT(null terminating), O(open) and top(unknown). If we index into the string and set a character to '\0', move the string to NT. The hard part here is knowing the size of the string. We need to make sure the index is not past the existing size of the string, measured either as strlen() on an NT char* or sizeof().
Check that we do not pass in O or M strings to methods that require NT. Also check that we meet our own out specifications.
| Wiki Markup |
|---|
There is a question of what to do about character arrays. One option is to assume that char\[\] is open, and using it as a char\* means that we first must make it null terminating. This could get annoying for developers very quickly. I think it's better to treat char\[\] as char*, that is, we assume NT and check for it. If the exception case does occur, it will have to be specified. |
This analysis also impacts Assume all in parameters require NT, all out params provide NT.
Write specialized handlers for any function where this is not the case (should not be too many. Default should be that strings are NT as soon as possible.)
O represents open strings, M represents maybe case (top of lattice).
Local analysis. Make sure we meet our own handler requirements, too.
Few false positives, as those that accept NT are specified. Probably will still get some FP from pointer magic.
Consider affects on STR03-A, STR07-A, and STR31-C.
Combined attack (SA/DA/T)
...