Skip to content

Commit 8cd6b13

Browse files
david-a-wheelerdavid-a-wheeler
authored
Add new lab free.html (#583)
* Add new lab free.html Signed-off-by: David A. Wheeler <[email protected]> * free.html: Add some explanatory detail Signed-off-by: David A. Wheeler <[email protected]> * Expand lab free Make the lab less trivial. Now, instead of just swapping the statements, the learner will have have an incentive to look at them more carefully (there are 6 different ways to order 3 statements). Signed-off-by: David A. Wheeler <[email protected]> * free.html: Minor reword Signed-off-by: David A. Wheeler <[email protected]> * free.html: Minor cleanup Signed-off-by: David A. Wheeler <[email protected]> * free.html: Mildly improve hints Signed-off-by: David A. Wheeler <[email protected]> --------- Signed-off-by: David A. Wheeler <[email protected]>
1 parent 49d8feb commit 8cd6b13

File tree

3 files changed

+193
-1
lines changed

3 files changed

+193
-1
lines changed

‎docs/labs/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ work on.
9393
* [Avoid Incorrect Conversion or Cast](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-incorrect-conversion-or-cast) - DONE-2 (Keith Grant via Vincent Danen, by 2024-07-26) [conversion](conversion.html)
9494
* Processing Data Securely: Undefined Behavior / Memory Safety
9595
* Countering Out-of-Bounds Reads and Writes (Buffer Overflow) - DONE-0 [oob1](oob1.html)
96-
* [Double-free, Use-after-free, and Missing Release](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#double-free-use-after-free-and-missing-release) <!-- was Bennett Pursell --> - PLANNED-1 UNASSIGNED
96+
* [Double-free, Use-after-free, and Missing Release](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#double-free-use-after-free-and-missing-release) <!-- was Bennett Pursell --> - DONE-1 (David A. Wheeler) [free](free.html)
9797
* [Avoid Undefined Behavior](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-undefined-behavior) - PLANNED-2 UNASSIGNED
9898
* Processing Data Securely: Calculate Correctly
9999
* [Avoid Integer Overflow, Wraparound, and Underflow](https://github.com/ossf/secure-sw-dev-fundamentals/blob/main/secure_software_development_fundamentals.md#avoid-integer-overflow-wraparound-and-underflow) - PLANNED-2, first draft by 2024-07-19 (Petr Matousek via Vincent Danen)

‎docs/labs/free.html‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<link rel="stylesheet" href="https://best.openssf.org/assets/css/style.css">
7+
<link rel="stylesheet" href="checker.css">
8+
<script src="js-yaml.min.js"></script>
9+
<script src="checker.js"></script>
10+
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
11+
12+
<!-- See create_labs.md for how to create your own lab! -->
13+
14+
<!-- Sample expected answer -->
15+
<script id="expected0" type="plain/text">
16+
asprintf(&result, "pre_%s_post", s);
17+
free(s);
18+
return result;
19+
</script>
20+
21+
<!-- Full pattern of correct answer -->
22+
<script id="correct0" type="plain/text">
23+
\s*
24+
asprintf \( & result , "pre_%s_post" , s \) ;
25+
free \( s \) ;
26+
return result ;
27+
\s*
28+
</script>
29+
30+
<script id="info" type="application/yaml">
31+
---
32+
hints:
33+
- present: |-
34+
\s*free[^;]*; asprintf
35+
text: Do not free the input first, you need to use it.
36+
examples:
37+
- - |-
38+
free(s);
39+
asprintf(&result, "pre_%s_post", s);
40+
- present: |-
41+
\s* asprintf \(
42+
absent: free
43+
text: This fails to free the memory, likely leading to a missing release.
44+
examples:
45+
- - |-
46+
asprintf(&result, ""pre_%s_post"", s);
47+
- absent: return
48+
text: This fails to return the result.
49+
- absent: |-
50+
\s* [^;]+;[^;]+;[^;]+; \s*
51+
text: There should be 3 statements, each terminated with a semicolon.
52+
examples:
53+
- - |-
54+
asprintf(&result, "pre_%s_post", s);
55+
free(s);
56+
return result
57+
- present: |-
58+
\s* return result ; free \s*
59+
text: Do not do anything after the return, it will not execute.
60+
examples:
61+
- - |-
62+
asprintf(&result, "pre_%s_post", s);
63+
return result;
64+
free(s);
65+
# debug: true
66+
</script>
67+
</head>
68+
<body>
69+
<!-- For GitHub Pages formatting: -->
70+
<div class="container-lg px-3 my-5 markdown-body">
71+
<h1>Lab Exercise free</h1>
72+
<p>
73+
This is a lab exercise on developing secure software.
74+
For more information, see the <a href="introduction.html" target="_blank">introduction to
75+
the labs</a>.
76+
77+
<p>
78+
<h2>Task</h2>
79+
<p>
80+
<b>Please fix the code below to fix a simple use-after-free bug.</b>
81+
82+
<p>
83+
<h2>Background</h2>
84+
<p>
85+
Practically all programming languages allow developers to
86+
quickly allocate memory and store data in that memory region.
87+
Once the program is finished using that memory,
88+
most programming languages automatically reclaim it.
89+
90+
<p>
91+
However, the programming languages
92+
C and C++ require <i>manual</i> memory management.
93+
That is, developers using C and C++
94+
must <i>manually</i> tell the system to release a memory region
95+
(using <tt>free</tt> and <tt>delete</tt> respectively).
96+
Manual memory management can have performance benefits, and it's
97+
conceptually simple.
98+
However, manual memory management can also lead to a variety of common types
99+
of bugs:
100+
101+
<ol>
102+
<li>Double-free: Release the same memory region more than once.
103+
<li>Use-after-free: Use the memory (for reading or writing) after it's
104+
been released.
105+
<li>Missing release: Fail to release memory after it's no longer used.
106+
</ol>
107+
108+
<p>
109+
These bugs often happen because it's difficult to be perfect, all the time,
110+
as software becomes larger and more complex.
111+
Many vulnerabilities have stemmed from manual memory management bugs.
112+
Not <i>all</i> such bugs are vulnerabilities, but many are.
113+
114+
<p>
115+
<h2>Task Information</h2>
116+
<p>
117+
118+
<p>
119+
Please change the C code below to fix a simple use-after-free bug.
120+
This code for the function <tt>tweak</tt> accepts a
121+
string named <tt>s</tt>.
122+
It must call the function <tt>asprintf</tt> to
123+
create a new string that contains the text
124+
<tt>pre_</tt>, the input text (<tt>s</tt>), and the text <tt>_post</tt>.
125+
The function <tt>tweak</tt> must eventually return this new result.
126+
Unfortunately the current code makes a call to <tt>free</tt> to release
127+
a memory region <i>before</i> the last use of that memory.
128+
This can lead to a "use-after-free" bug.
129+
Whether or not this bug can cause a problem depends on
130+
many implementation details, but we don't want it to ever cause a problem.
131+
132+
<p>
133+
Please fix this code!
134+
135+
<p>
136+
<h2>Interactive Lab (<span id="grade"></span>)</h2>
137+
<p>
138+
<form id="lab">
139+
<pre><code
140+
>#include &lt;stdlib.h&gt;
141+
#include &lt;string.h&gt;
142+
#include &lt;stdio.h&gt;
143+
144+
// Return tweaked version of string s. Frees s.
145+
char *tweak(char *s) {
146+
char *result; // Put result here
147+
<textarea id="attempt0" rows="4" cols="60" spellcheck="false">
148+
free(s);
149+
asprintf(&result, "pre_%s_post", s);
150+
return result;
151+
</textarea>
152+
}
153+
</code></pre>
154+
<button type="button" class="hintButton">Hint</button>
155+
<button type="button" class="resetButton">Reset</button>
156+
<button type="button" class="giveUpButton">Give up</button>
157+
<br><br>
158+
<p>
159+
<i>This lab was developed by David A. Wheeler at
160+
<a href="https://www.linuxfoundation.org/"
161+
>The Linux Foundation</a>.</i>
162+
<br><br>
163+
<p id="correctStamp" class="small">
164+
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly>
165+
</textarea>
166+
</form>
167+
</div><!-- End GitHub pages formatting -->
168+
</body>
169+
</html>

‎docs/labs/src/free.c‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// To compile and run:
2+
// gcc free.c ; ./a.out
3+
4+
#include <stdlib.h>
5+
#include <string.h>
6+
#include <stdio.h>
7+
8+
char *tweak(char *s) {
9+
char *result;
10+
asprintf(&result, "pre_%s_post", s);
11+
free(s);
12+
return result;
13+
}
14+
15+
int main() {
16+
char *s = "This is a test";
17+
// Create something we can free
18+
char *modify = strdup(s);
19+
// Create modified version
20+
char *res = tweak(modify);
21+
printf("Result = %s\n", res);
22+
}
23+

0 commit comments

Comments
 (0)