Overview1 PDF
Overview1 PDF
Mooly Sagiv
[email protected]
Thursday 9-11, Schriber 317
TA: Orr Tamir
ortamir@post
Thursday 11-12, Open Space
http://www.cs.tau.ac.il/~msagiv/courses/pl14.html
Architect Programmer
Programming
Language
Compiler,
Testing Runtime
environ-ment
DiagnosticTools
What’s new in programming languages
a = malloc(…) ;
b = a;
free (a);
c = malloc (…);
if (b == c) printf(“unexpected equality”);
18
Conflicting Arrays with Pointers
• An array is treated as a pointer to first
element
• E1[E2] is equivalent to ptr dereference:
*((E1)+(E2))
• Programmers can break the abstraction
• The language is not type safe
– Even stack is exposed
Buffer Overrun Exploits
void foo (char *x) {
foo
char buf[2];
strcpy(buf, x);
} main
…
}
source code
Returnda
address
buf[2]
ab
terminal memory
Buffer Overrun Exploits
int check_authentication(char *password) {
int auth_flag = 0;
char password_buffer[16];
strcpy(password_buffer, password);
if(strcmp(password_buffer, "brillig") == 0) auth_flag = 1;
if(strcmp(password_buffer, "outgrabe") == 0) auth_flag = 1;
return auth_flag;
}
int main(int argc, char *argv[]) {
if(check_authentication(argv[1])) {
printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
printf(" Access Granted.\n");
printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n"); }
else
printf("\nAccess Denied.\n");
}
(source: “hacking – the art of exploitation, 2nd Ed”)
Exploiting Buffer Overruns
evil input
Application
Pascal C
Smalltalk
ML Modula C++
Haskell Java
Many others: Algol 58, Algol W, Scheme, EL1, Mesa (PARC), Modula-2,
Oberon, Modula-3, Fortran, Ada, Perl, Python, Ruby, C#, Javascript, F#…
Most Research Languages
Practitioners
1,000,000
10,000
100
Geeks
1,000,000
10,000
100
The slow death
Geeks
1,000,000
10,000
The complete
100 absence of death
Geeks
100
The second life?
Geeks
24/3 Haskel
7/4 Prolog
? Hazara Hazara
Summary
• Learn cool programming languages
• Learn useful programming language concepts
• But be prepared to program
– Public domain software