Integer and String Vulnerabilities in C

Software security is a critical topic that has been the focus of attention of many researchers and professionals over the years. One of the reasons this subject does not lose relevance is the number of vulnerabilities that become known each day. According to NVD (2006), a vulnerability can be defined as "a weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact on confidentiality, integrity, or availability". The numbers surrounding this type of computational issue give a more concrete panorama about its criticality. Seacord (2013) states that in a period of nine years — from 2004 to 2012 — a total of 45,135 vulnerabilities were reported and cataloged by the National Vulnerabilities Database — NVD — of the National Institute of Standards and Technology — NIST. Yet, only in the year 2019, the NVD received 18,938 new entries.

In terms of secure programming, two categories of vulnerabilities have been exploited by attackers so that to damage the correct running flow of a software. The first one is String-related vulnerabilities. Basically, failures of this category cause a kind of security threat known as buffer overflow. Another widespread category of vulnerabilities is Integer-related. The most common errors found out in this category are overflow and signed errors. All those situations can lead to unexpected behaviors and the system can end up in an unsecured state. In scenarios like those ones, mitigation strategies turned to avoid jeopardizing a program or even a whole system generally are based on a solid knowledge of the employed programming language and in an accurate manner to explore its resources.