Page History

The location in memory of a function is computed at compile time and then stored for later use by the program. If an attacker can overwrite certain memory containing function pointers, they may  they may be able to execute arbitrary code. To mitigate the effects of such attacks, pointers to functions can be encrypted at runtime based on some runtime on the basis of some characteristics of the execution process so that only a running process will be able to decode them.  This is only required for stored function pointers stored to writable memory, including the stack.  The Microsoft SDL [Microsoft 2012] recommends encoding long-lived pointers in your code.

Noncompliant Code Example

This noncompliant code example assigns the address of the printf() function to the log_fn function pointer, which can be allocated in the stack or data segment.:

int (*log_fn)(const char *, ...) = printf;
/* ... */
log_fn("foo");

If a vulnerability exists in this program that allows an attacker to overwrite the log_fn function pointer, such as a buffer overflow or arbitrary memory write, the attacker may be able to overwrite the value of printf with the location of an arbitrary function.

Compliant Solution (Windows)

Microsoft Windows provides the EncodePointer() and DecodePointer() function functions that encrypt and decrypt pointers using a secret that is unique to the given process.:

int (#include <Windows.h>
 
void *log_fn)(const char *, ...) = EncodePointer(printf);
/* ... */
DecodePointer(log_fn)("foo");

Compliant Solution (C1X)

Two similar functions are under consideration for the C1X major revision to the C Standard.

C1X defines encode_pointer() to have the following behavior:

The encode_pointer function shall perform a transformation on the pf argument, such that the decode_pointer function shall reverse that transformation. Thus, for any pointer to function pfun,

Code Block
decode_pointer(encode_pointer( (void(*)()) pfun )

when converted to the type of pfun, shall equal pfun.

int (*log_fn)(const char *, ...) = encode_pointer(printf);
/*(int (*)(const char *, ... */
decode_pointer))DecodePointer(log_fn);

fn("foo");

Note that DecodePointer() does not return success or failure.  If an attacker has overwritten the pointer contained in log_fn, the pointer returned will be invalid and cause your application to crash.  However, this is preferable to giving an attacker the ability to execute arbitrary code. 

Risk Assessment

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

...

...

...

Bibliography

 , DecodePointer()

...

Image Modified Image Modified Image Modified