T09 · Insecure Skill Coding Practices
Warning
- Location
- code.c:100
- Finding
- Unvalidated Numeric Arguments Enable Memory Corruption and Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `code.c`, lines 100–111 and 207–223 **Vulnerability Type**: Unchecked numeric conversion, integer overflow, unchecked memory allocation, and unbounded resource consumption **Risk Level**: Medium ### Vulnerable Code ```c // Store results double **results = malloc(num_methods * sizeof(double*)); for (int i = 0; i < num_methods; i++) { results[i] = malloc(repetitions * sizeof(double)); } // Randomize test order srand(42); int total_tests = num_methods * repetitions; int *test_sequence = malloc(total_tests * sizeof(int)); for (int i = 0; i < num_methods; i++) { for (int j = 0; j < repetitions; j++) { test_sequence[i * repetitions + j] = i; } } ``` The affected dimensions originate directly from command-line arguments: ```c int main(int argc, char *argv[]) { int num_fields = DEFAULT_FIELDS; int num_records = DEFAULT_RECORDS; int repetitions = DEFAULT_REPETITIONS; for (int i = 1; i < argc; i++) { if (strcmp(argv[i], "--fields") == 0 && i + 1 < argc) { num_fields = atoi(argv[++i]); } else if (strcmp(argv[i], "--records") == 0 && i + 1 < argc) { num_records = atoi(argv[++i]); } else if (strcmp(argv[i], "--repetitions") == 0 && i + 1 < argc) { repetitions = atoi(argv[++i]); } } printf("代码重构效率基准测试\n"); run_experiment(num_fields, num_records, repetitions); ``` ### Technical Analysis The program converts attacker-controlled arguments with `atoi()`. This function cannot distinguish a valid zero from malformed input and provides no reliable overflow or range-error reporting. The resulting signed integers are passed directly to loop bounds, allocation-size calculations, and arithmetic. The `repetitions` value is particularly dangerous: 1. `repetitions * sizeof(double)` is converted to the unsigned allocation type. A negative value can therefore become an extremely large requested allocation. ...[truncated 2726 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `atoi()` with `strtol()` or `strtoul()` and validate the complete input: - Reset and inspect `errno`. - Reject empty values and trailing non-numeric characters. - Reject zero and negative values where they are invalid. - Reject values outside the destination type's range. 2. Apply explicit operational limits, for example: - Maximum field count. - Maximum record count. - Maximum repetition count. These limits should reflect the expected runtime and memory budget. 3. Use `size_t` for element counts and allocation sizes rather than signed `int`. 4. Check every multiplication before allocating: ```c if (repetitions > SIZE_MAX / sizeof(double)) { fprintf(stderr, "Repetition count is too large\n"); return; } ``` 5. Check compound count calculations before use: ```c if (repetitions > SIZE_MAX / (size_t)num_methods) { fprintf(stderr, "Test count overflow\n"); return; } size_t total_tests = (size_t)num_methods * repetitions; ``` 6. Verify every allocation before dereferencing it. On failure, release all allocations already made and return an error: ```c double **results = calloc((size_t)num_methods, sizeof(*results)); if (results == NULL) { perror("calloc"); return; } ``` 7. Prevent invalid statistical operations by requiring `repetitions > 0` before starting the experiment. 8. Return a nonzero exit status when validation or allocation fails so that calling automation can reliably detect the failure. 9. Consider applying process-level CPU and memory limits when the benchmark can be invoked by untrusted users. ]]>