This lecture continues the exploration of low-level vulnerabilities begun in the previous lecture. It considers the dangers of C’s printf function and examines how the implementation of dynamic binding in object-oriented C++ programs can be exploited. It also considers issues arising from integer overflow and discusses how these issues can lead to other problems such as buffer overruns.

• No lecture video available
• Slides (PDF)
• Code examples
• Other resources:
  • Howard, LeBlanc & Viega, 24 Deadly Sins of Software Security (Chapters 6 & 7)
  • “Attacking SSL VPN… with Uber as Case Study!” - a recent exploit involving printf
  • Example of fixing an integer overflow (CVE-2016-9387)
  • SafeInt library