Lecture 7 pt 2: Background for Software Security and Testing

목차

 

Why care about C/C++?

Software in C/C++ is necessary because:
- it is performant (성능 기준에 맞는)
- it facilitates communication with or control of the hardware (하드웨어 컨트롤)

 

A lot of languages, including safe languages still use components in C/C++
We have inherited a lot of (legacy) software coded in these languages

 

CPUs only Understand Binary

C, C++ code → Compiler → Binary code

For other languages, such as Python and Java, interpreter or just-in-time compiler frequently written in C/C++

Libraries also frequently written in C/C++

VMs also written in C

 

 

Java

Main goal: Programmer productivity

Used by just about everyone (rich ecosystem)

Platform independent

Automatic memory management

Memory safe guaranteed

→ Immune to memory errors

 

 

C

Main goals: performance and absolute control of resources

Used mostly by system programmers

Platform dependent

Manual memory management

Memory safety not guaranteed

→ Prone to memory errors

 

 

Memory Errors

Memory errors are bugs in handling memory in memory unsafe languages → A program accesses memory that it should not

gets does not perform bounds checking on the size of the input

No problem if the user respects buf's size

 

즉, input의 크기가 처음에 설정한 값이 처리를 할 수 있는 크기면 괜찮은데 input 크기가 이 값을 벗어나면 에러

→ Stack Buffer Overflow