Information Technology - Question Assessment Answer

Question 2 

The following program is for Question 2.   

#include <stdio.h> #include <stdlib.h> #include <string.h>  

1. int main(int argc, char *argv[]) { 2.   char *first, *second, *third;  

3.   if (argc < 2)  4.   { a. printf("usage: ./q1 str\n"); b. exit(1); 5.   }  

6.   first = (char *) malloc(660); 7.   second = (char *) malloc(220); 8.   third = (char *) malloc(120); 9.   strcpy(second, argv[1]);                 10. printf("locations of the 1st, 2nd, and 3rd memory trunks      are %p, %p, %p \n",  first, second, third); 11. printf("contents of the 2nd memory trunk are %s\n", second);          12. free(first);                             13. free(second); 14. free(third); 15. }   

In the program, %p in the printf() function prints the location of the allocated memory chunk. Compile the program to build the executable file.  

(1) Illustrate how the 1st, 2nd and 3rd chunks of memory are allocated and linked in the program. Work out the number of bytes needed for each memory chunk and the values in the memory chunk header.           (5 marks)  

(2) Analyze the vulnerability of the program to a buffer overflow attack by using a malicious argument of argv[1] which contians 224 bytes with the last four bytes being written with the value 4.            (5 marks) 

4  

Question 3 

The following program is for Question 3.    

#include <stdlib.h> #include <string.h> #include <stdio.h>  

1. void getComment(unsigned int len, char *src) { 2.     unsigned int size;  

3.     size = len – 4;                4.     char *comment = malloc(size+1); 5.     memcpy(comment, src, size); 6.     printf("%s\n", comment); 7.     return; 8. }  

9. int main(int argc, char* argv[]) {  

10. if (argc < 3) { 11. printf("Usage: %s <str1> <str2>\n", argv[0]); 12. return -1; 13. }  

14. getComment(atoi(argv[1]), argv[2]); 15. return 0; 16. }   

Compile the program to build the executable file. 

(1) Give an example of a normal run of the program. Illustrate clearly the input, output and the values of the variables “len” and “size” in your example.    (4 marks) 

(2) Give an example of an abnormal run of the program which ends up with “Segmentation Fault” Analyze what causes the problem and how the vulnerability can be fixed. Fix the program and run it again with the same input.  The “Segmentation Fault” should not happen again.            (6 marks)