Overflow

This is a discussion on Overflow within the C Programming forums, part of the General Programming Boards category; guys, this is my code: Code: int array[5]; int index; int i; for (i=0;i<5;i = i+1) { printf ("please enter ...

  1. #1
    1337
    Join Date
    Jul 2008
    Posts
    135

    Overflow

    guys, this is my code:

    Code:
    int array[5];
    int index;
    int i;
    
    for (i=0;i<5;i = i+1)
      {
     printf ("please enter integer number %d:", i+1);
       scanf ("%f", &array[i]);
    }
    
    printf ("which integer number you want to see");
    fflush (stdin);
    scanf ("%d", &index);
    printf ("number %d is %f", index, array[index-1]);
    i entered 1.1, 2.2, 3.3, 4.4, 5.5 into the array and when it prompt for the "which integer number you want to see" i entered 5, so it showed 5.5. However, what if i typed 6 or some other numbers? Will it cause my program to be vulnerable?

  2. #2
    C++ Witch laserlight's Avatar
    Join Date
    Oct 2003
    Location
    Singapore
    Posts
    21,749
    Your code seems to have an infinite loop since 1 < 5 is always true. Stop using fflush(stdin).

    Quote Originally Posted by valthyx
    However, what if i typed 6 or some other numbers? Will it cause my program to be vulnerable?
    Your program already is vulnerable since it does not check to prevent array out of bounds access.
    C + C++ Compiler: MinGW port of GCC
    Version Control System: Bazaar

    Look up a C++ Reference and learn How To Ask Questions The Smart Way

  3. #3
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Right, so you store float values in an integer, array, and then pass that onto printf with a float type output. That's definitely in "undefined behaviour" land.

    If you use the correct types, you should get the correct values.

    Also, fflush(stdin) is undefined - it MAY do what you expect it to do, but it may also explode in your face if you are not so lucky - see the FAQ.

    As to the array overflow - since you are not STORING values in the array, it's fairly harmless. Beyond showing values of complete rubbish, the most likely bad thing that can happen is that the process gets killed for accessing outside of it's allowed memory [1]. Vulnerability from array index overflows happen when the user can WRITE to memory that is beyond what he/she is supposed to enter data into. This is particularly so if the memory also can lead to execution of the data entered, such as local array variables.

    [1] Note however that in certain situation, this can stop other processes from functioning correctly. For example, if the current process creates a lock-file to prevent other processes of the same kind from accessing some shared resource, then that lock-file should be removed when the process exits, but it being killed like this, it will not exit the normal way - not even exit-handlers such as "onexit()" will run.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by laserlight View Post
    Your code seems to have an infinite loop since 1 < 5 is always true.
    Huh?

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  5. #5
    Registered User
    Join Date
    Dec 2006
    Location
    Canada
    Posts
    3,183
    Code:
    i = i+1)
    More conventionally
    Code:
    i++)

  6. #6
    C++ Witch laserlight's Avatar
    Join Date
    Oct 2003
    Location
    Singapore
    Posts
    21,749
    Quote Originally Posted by matsp
    Huh?
    Yes, it was a 1, not an i or an l. Speaking of which: valthyx, next time copy and paste from your editor/IDE instead of rewriting the code. It makes things more difficult when new typographical errors obscure what you are talking about in your actual code.
    C + C++ Compiler: MinGW port of GCC
    Version Control System: Bazaar

    Look up a C++ Reference and learn How To Ask Questions The Smart Way

  7. #7
    1337
    Join Date
    Jul 2008
    Posts
    135
    Laserlight.. sorry, yes, i retyped it (error-prone),.

    Why shouldnt i use fflush()? what else can i use?

    I use it because my tutorial taught me so. I am still new.

  8. #8
    Registered User
    Join Date
    Dec 2006
    Location
    Canada
    Posts
    3,183
    see the FAQ
    Have you?

  9. #9
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by valthyx View Post
    Laserlight.. sorry, yes, i retyped it (error-prone),.

    Why shouldnt i use fflush()? what else can i use?

    I use it because my tutorial taught me so. I am still new.
    Your tutorial is teaching you BAD habits!

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  10. #10
    1337
    Join Date
    Jul 2008
    Posts
    135
    I am actually leaning c programming from video traning. He taught me those wrong things.

    Previously, I tried to learn from "The C programming language 2nd edition" but sometimes I could not follow the tutorials in there, I felt that it is lack of explanation. So, i decided to stop reading it. Please suggest some other books where it will teach you from beginner to advanced level. And I would like to learn about socket programming and those #include signal.h (includes)..etc....as well.

    Any suggestion of books?
    Last edited by valthyx; 06-01-2009 at 10:17 AM.

  11. #11
    DESTINY BEN10's Avatar
    Join Date
    Jul 2008
    Location
    in front of my computer
    Posts
    804
    Quote Originally Posted by valthyx View Post
    I am actually leaning c programming from video traning. He taught me those wrong things.

    Previously, I tried to learn from "The C programming language 2nd edition" but sometimes I could not follow the tutorials in there, I felt that it is lack of explanation. So, i decided to stop reading it. Please suggest some other books where it will teach you from beginner to advanced level. And I would like to learn about socket programming and those #include signal.h (includes)..etc....as well.

    Any suggestion of books?
    I would suggest you Let Us C by Yashwant kanetkar. I know that that book doesn't follow standard C but it will definitely give you deep explanation of everything. And once you know the basics you can go to other advanced books also.
    HOPE YOU UNDERSTAND.......

    By associating with wise people you will become wise yourself
    It's fine to celebrate success but it is more important to heed the lessons of failure
    We've got to put a lot of money into changing behavior


    PC specifications- 512MB RAM, Windows XP sp3, 2.79 GHz pentium D.
    IDE- Microsoft Visual Studio 2008 Express Edition

  12. #12
    Registered User
    Join Date
    Sep 2008
    Location
    Toronto, Canada
    Posts
    1,832
    Quote Originally Posted by matsp View Post
    Also, fflush(stdin) is undefined - it MAY do what you expect it to do, but it may also explode in your face if you are not so lucky - see the FAQ.
    I'd like to look that up but I did a search for "flush", "fflush", "stdin" in the FAQ forums and couldn't find anything.

  13. #13
    Banned ಠ_ಠ's Avatar
    Join Date
    Mar 2009
    Posts
    687
    Quote Originally Posted by nonoob View Post
    I'd like to look that up but I did a search for "flush", "fflush", "stdin" in the FAQ forums and couldn't find anything.
    really? because it's the first result for all of those
    ╔╗╔══╦╗
    ║║║╔╗║║
    ║╚╣╚╝║╚╗
    ╚═╩══╩═╝

  14. #14
    and the Hat of Guessing tabstop's Avatar
    Join Date
    Nov 2007
    Posts
    14,185
    Quote Originally Posted by nonoob View Post
    I'd like to look that up but I did a search for "flush", "fflush", "stdin" in the FAQ forums and couldn't find anything.
    Not that hard to find: Cprogramming.com FAQ > Why fflush(stdin) is wrong

  15. #15
    Registered User
    Join Date
    Sep 2008
    Location
    Toronto, Canada
    Posts
    1,832
    Sorry, people. I was looking in the "FAQ Board" ( FAQ Board ). Now I don't know what good that place is.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Overflow and range checking for mul/div
    By Elysia in forum C++ Programming
    Replies: 28
    Last Post: 06-06-2008, 02:09 PM
  2. Problem using sscanf fgets and overflow checking
    By jou00jou in forum C Programming
    Replies: 5
    Last Post: 02-18-2008, 05:42 AM
  3. Stack overflow errors in 3 areas
    By ulillillia in forum C Programming
    Replies: 13
    Last Post: 04-29-2007, 03:20 PM
  4. Signed Char Overflow
    By coder8137 in forum C Programming
    Replies: 5
    Last Post: 11-17-2006, 07:25 AM
  5. large program code ,please help
    By Ash1981 in forum C Programming
    Replies: 14
    Last Post: 01-30-2006, 05:16 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21