Question

I have a C\C++ code that receives a structure over the network, from this form:

struct DataStruct
{
int DataLen;
BYTE* Data;
}

The code I have runs over Data in a loop of DataLen times and processes the data.

…The problem:

After the code came to security experts for penetration tests, they prepared a fake application which sends this struct with DataLen bigger than the real length of Data. This causes, of course, an access violation exception.

So, the question is – how can I validate the real length of the received Data? Is it possible without changing the structure?

Thanks in advance.

Answer 1

Nice security experts! I wish my company had a department like that.

Whenever data is received from the network, the network IO reports the number of bytes actually written to the buffer, whether you used read(2), recv(2), or boost::asio::async_read or anything else I’ve seen. Typical use case when there’s a “number of bytes to follow” field in the header of your data structure, is to repeatedly call read/recv/etc until that many bytes were received (or until error occurred), and only then it should construct and return your DataStruct (or report error).