Re: Handling numeric types in interpreter

From	Keith Thompson <kst-u@mib.org>
Newsgroups	comp.lang.c
Subject	Re: Handling numeric types in interpreter
Date	2015-07-25 15:42 -0700
Organization	None to speak of
Message-ID	<lnk2tnyi3b.fsf@kst-u.example.com> (permalink)
References	(3 earlier) <mourp8$mf$1@dont-email.me> <movvkj$leq$1@news.xmission.com> <91ee1672-182a-4968-8d22-610a21495452@googlegroups.com> <2ps7ra1v3slc1mhv28nmir41ikqmskohga@4ax.com> <0f35d148-da44-4330-9458-efc31ec21857@googlegroups.com>

Show all headers | View raw

Malcolm McLean <malcolm.mclean5@btinternet.com> writes:
[...]
> TIFF files allow values to be entered as 32 bit longs. A byte buffer
> could easily use most of this range (the standard suggests limiting
> buffers to about 8K, but this isn't enforced). The realistic risk
> is that we'll need to multiply two 32 values, and end up with
> a valid seeming but actually wrong answer, and a buffer overflow
> attack.
> Doubles help because the result should still be representable.
> It won't be accurate, but it will be obviously out of the
> sensible range, and thus easier to reject.

The product of two 32-bit values will fit in a long long.

If you need to deal with compilers that don't support long long
(or another 64-bit integer type), you might consider writing two
alternative implementation, a simpler one that just uses integer
arithmetic and another that uses floating-point.  As support
for 64-bit integers becomes more widespread (it's probably close
to universal now, with pre-C99 compilers supporting them as an
extension), you can deprecate the other version.

> But making the reader robust to any attack whatsoever is a major
> challenge when writing it in C. Lib Tiff has suffered from exactly
> that problem. 

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

Thread

Handling numeric types in interpreter luser droog <luser.droog@gmail.com> - 2015-07-13 19:33 -0700
  Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-14 07:31 +0200
  Handling numeric types in interpreter asetofsymbols@gmail.com - 2015-07-14 00:35 -0700
  Re: Handling numeric types in interpreter David Kleinecke <dkleinecke@gmail.com> - 2015-07-14 08:55 -0700
  Re: Handling numeric types in interpreter Bartc <bc@freeuk.com> - 2015-07-15 23:18 +0100
    Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-24 00:21 -0700
      Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-24 08:36 -0700
        Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-24 11:04 -0700
          Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-24 12:25 -0700
            Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-24 22:21 -0400
              Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 02:28 -0700
                Re: Handling numeric types in interpreter Bartc <bc@freeuk.com> - 2015-07-25 15:16 +0100
                Re: Handling numeric types in interpreter Richard Damon <Richard@Damon-Family.org> - 2015-07-25 11:03 -0400
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-25 10:05 -0700
              Re: Handling numeric types in interpreter gazelle@shell.xmission.com (Kenny McCormack) - 2015-07-25 12:32 +0000
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 06:12 -0700
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-25 10:08 -0700
                Re: Handling numeric types in interpreter ais523 <ais523@nethack4.org> - 2015-07-28 17:50 +0000
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-28 11:52 -0700
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-28 12:25 -0700
                Re: Handling numeric types in interpreter Richard Heathfield <rjh@cpax.org.uk> - 2015-07-28 20:52 +0100
                Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-28 23:01 +0200
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-28 14:44 -0700
                Re: Handling numeric types in interpreter Ian Collins <ian-news@hotmail.com> - 2015-07-29 09:43 +1200
                Re: Handling numeric types in interpreter glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-07-28 23:10 +0000
                Re: Handling numeric types in interpreter Ian Collins <ian-news@hotmail.com> - 2015-07-29 12:04 +1200
                Re: Handling numeric types in interpreter Melzzzzz <mel@zzzzz.com> - 2015-07-29 02:39 +0200
                Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-29 12:04 +0200
                Re: Handling numeric types in interpreter glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-07-29 14:58 +0000
                Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-29 14:14 +0200
                Re: Handling numeric types in interpreter Bartc <bc@freeuk.com> - 2015-07-29 13:29 +0100
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-29 08:48 -0700
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-29 08:45 -0700
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-28 16:28 -0700
                Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-29 12:02 +0200
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-29 08:51 -0700
                Re: Handling numeric types in interpreter jacobnavia <jacob@jacob.remcomp.fr> - 2015-07-29 18:35 +0200
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-29 10:47 -0700
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-25 15:46 -0500
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 14:08 -0700
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-25 15:42 -0700
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-26 00:31 -0500
                Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-25 17:48 -0400
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-25 17:31 -0500
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 15:57 -0700
                Re: Handling numeric types in interpreter Bartc <bc@freeuk.com> - 2015-07-26 01:07 +0100
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 17:26 -0700
                Re: Handling numeric types in interpreter Richard Damon <Richard@Damon-Family.org> - 2015-07-25 22:25 -0400
                Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-25 19:04 -0400
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-26 00:23 -0500
                Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-26 08:24 -0400
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-26 06:36 -0700
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-26 16:30 -0500
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-26 15:42 -0700
                Re: Handling numeric types in interpreter Robert Wessel <robertwessel2@yahoo.com> - 2015-07-26 16:28 -0500
                Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-26 18:57 -0400
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-26 16:20 -0700
                Re: Handling numeric types in interpreter Keith Thompson <kst-u@mib.org> - 2015-07-25 15:58 -0700
              Re: Handling numeric types in interpreter James Kuyper <jameskuyper@verizon.net> - 2015-07-25 12:56 -0400
                Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-25 14:18 -0700
      Re: Handling numeric types in interpreter glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-07-24 18:06 +0000
        Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-24 11:16 -0700
          Re: Handling numeric types in interpreter glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-07-24 23:06 +0000
            Re: Handling numeric types in interpreter Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-07-24 16:21 -0700
  Re: Handling numeric types in interpreter Michael Angelo Ravera <maravera@prodigy.net> - 2015-07-15 19:13 -0700
    Re: Handling numeric types in interpreter luser droog <luser.droog@gmail.com> - 2015-07-23 08:36 -0700

csiph-web