strcpy() function interview question c programming

Question: Following is the code for very basic password protection. Can you break it without knowing the password?

#include

int main(int argc, char *argv[])
{
    int flag = 0;
    char passwd[10];

    memset(passwd,0,sizeof(passwd));

    strcpy(passwd, argv[1]);

    if(0 == strcmp("LinuxGeek", passwd))
    {
        flag = 1;
    }

    if(flag)
    {
        printf("\n Password cracked \n");
    }
    else
    {
        printf("\n Incorrect passwd \n");

    }
    return 0;
}

Answer: Yes. The authentication logic in above password protector code can be compromised by exploiting the loophole of strcpy() function. This function copies the password supplied by user to the ‘passwd’ buffer without checking whether the length of password supplied can be accommodated by the ‘passwd’ buffer or not. So if a user supplies a random password of such a length that causes buffer overflow and overwrites the memory location containing the default value ’0′ of the ‘flag’ variable then even if the password matching condition fails, the check of flag being non-zero becomes true and hence the password protection is breached.

For example :

$ ./psswd aaaaaaaaaaaaa

 Password cracked

So you can see that though the password supplied in the above example is not correct but still it breached the password security through buffer overflow.

To avoid these kind of problems the function strncpy() should be used.

Note from author : These days the compilers internally detect the possibility of stack smashing and so they store variables on stack in such a way that stack smashing becomes very difficult. In my case also, the gcc does this by default so I had to use the the compile option ‘-fno-stack-protector’ to reproduce the above scenario.

www.cinterviews.com appreciates your contribution please mail us the questions you have to cinterviews.blogspot.com@gmail.com so that it will be useful to our job search community

strcpy() function in C Language

• strcpy( ) function copies contents of one string into another string. Syntax for strcpy function is given below.

char * strcpy ( char * destination, const char * source );

• Example:

strcpy ( str1, str2) – It copies contents of str2 into str1.
strcpy ( str2, str1) – It copies contents of str1 into str2.

• If destination string length is less than source string, entire source string value won’t be copied into destination string.
• For example, consider destination string length is 20 and source string length is 30. Then, only 20 characters from source string will be copied into destination string and remaining 10 characters won’t be copied and will be truncated.

Example program for strcpy( ) function in C language:

• In this program, source string “fresh2refresh” is copied into target string using strcpy( ) function.

C

1 2 3 4 5 6 7 8 9 10 11 12 13

#include <stdio.h> #include <string.h>   int main( ) {    char source[ ] = "fresh2refresh" ;    char target[20]= "" ;    printf ( "\nsource string = %s", source ) ;    printf ( "\ntarget string = %s", target ) ;    strcpy ( target, source ) ;    printf ( "\ntarget string after strcpy( ) = %s", target ) ;    return 0; }

Output:

source string = fresh2refresh target string = target string after strcpy( ) = fresh2refresh

Other String functions in C Language:

• String.h header file supports all the string functions in C language. All the string functions are given below.

S.no	String functions	Description
1	strcat ( )	Concatenates str2 at the end of str1.
2	strncat ( )	appends a portion of string to another
3	strcpy ( )	Copies str2 into str1
4	strncpy ( )	copies given number of characters of one string to another
5	strlen ( )	gives the length of str1.
6	strcmp ( )	Returns 0 if str1 is same as str2. Returns <0 if strl < str2. Returns >0 if str1 > str2.
7	strcmpi ( )	Same as strcmp() function. But, this function negotiates case.  “A” and “a” are treated as same.
8	strchr ( )	Returns pointer to first occurrence of char in str1.
9	strrchr ( )	last occurrence of given character in a string is found
10	strstr ( )	Returns pointer to first occurrence of str2 in str1.
11	strrstr ( )	Returns pointer to last occurrence of str2 in str1.
12	strdup ( )	duplicates the string
13	strlwr ( )	converts string to lowercase
14	strupr ( )	converts string to uppercase
15	strrev ( )	reverses the given string
16	strset ( )	sets all character in a string to given character
17	strnset ( )	It sets the portion of characters in a string to given character
18	strtok ( )	tokenizing given string using delimiter

www.cinterviews.com appreciates your contribution please mail us the questions you have to cinterviews.blogspot.com@gmail.com so that it will be useful to our job search community