Making "Hard" C code

[madfool81]

I'm writing a daemon service for Solaris 8 in C. It's not very complicated, but I have to consider making the code hard, as it's going to be public facing.

This sparc box has been configured to trap buffer overflow attacks (I like that feature! ), and my code has been written to try and trap those as well: e.g. no "strcpy"s in the code (I'm using "strncpy" and "memcpy" instead) etc.

Does anyone know of any other common attack methods that I should be looking for within the code?

Any thoughts welcome. Thanks.

[Daniel ~]

Welcome to our forums madfool81, We hope to see you in Seattle!!

[Aedan]

Originally posted by madfool81
Does anyone know of any other common attack methods that I should be looking for within the code?

Hmm, the most common basic application mistakes:-

Buffer Overflows
Format string bugs
Not sanitizing input

As for trapping buffer overflows within Solaris, you might want to read some of the work by people like Solar Designer, Nergal and John McDonald. They have all worked on methods of working around Solaris's non-exec stack.

AidanII