防止C/C++中的缓冲区溢出-PreventingbufferoverflowinC/C++

Don't use raw C-style arrays. Instead, use C++ container classes such as std::vector, which have the ability to check for invalid accesses and raise exceptions when they occur.

不要使用原始C风格的数组。相反,使用诸如std :: vector之类的C ++容器类,它们能够检查无效访问并在异常访问发生时引发异常。

Also, what you are describing is not really a buffer overflow.

此外,您所描述的并不是真正的缓冲区溢出。

Solution at the code level

In C++, one solution is to never use arrays, but C++ containers instead. Vectors, for example, have out of bounds detection if you use at intead of [] for indexing

在C ++中,一种解决方案是永远不使用数组,而是使用C ++容器。例如,如果在[]的intead处使​​用索引,则向量具有超出范围的检测

In C, you should always design your functions such as you give the pointers and the dimension(s) of your arrays, there is no way around it.

在C中,你应该总是设计你的函数,比如你给出指针和数组的维度,没有办法解决它。

Solution at the tool level

A great tool for checking out of bounds access is valgrind. It works by running your binary unaltered, and can give the precise line where errors occurs if you compile with debug information. Valgrind work on many unix, including mac os x.

valgrind是一个检查越界访问的好工具。它的工作方式是不加改变地运行二进制文件,如果使用调试信息进行编译,则可以给出出现错误的精确行。 Valgrind在许多unix上工作,包括mac os x。

Note that valgrind cannot always detect those bad accesses (in your example, assuming it was a real out of bounds access, it would have gonve unnoticed by valgrind because the variable is on the stack, not on the heap).

请注意,valgrind无法始终检测到那些错误的访问(在您的示例中,假设它是一个真正的越界访问,它会被valgrind忽略,因为变量在堆栈上,而不在堆上)。

In addition to the other comments, you might also have a look at the suggestions in this thread, which deals with static code analysis tools:

除了其他注释之外,您还可以查看此主题中的建议,该主题涉及静态代码分析工具:

C/C++ Free alternative to Lint?

C / C ++免费替代Lint?

I've found an interesting software for buffer overflow. You can download it for free from www.bugfighter-soft.com

我发现了一个有趣的缓冲区溢出软件。您可以从www.bugfighter-soft.com免费下载

It says that it can discover buffer overflow and that it is independent from compiler and platform.

它说它可以发现缓冲区溢出,并且它独立于编译器和平台。

I tried it with Visual C++ Express 2008 and it worked well. I could discover buffer overflow in a multidimensional array such int y[10][10][10];

我尝试使用Visual C ++ Express 2008,它运行良好。我可以发现多维数组中的缓冲区溢出,例如[10] [10] [10];

Do you think it is cross platform?

你认为它是跨平台的吗?

Do you know something more about it?

你知道更多关于它的事吗?

using sprintf in TRACE MACROS is the biggest evil

在TRACE MACROS中使用sprintf是最大的罪恶