c - 安全漏洞: What is the error in this piece of code?

Question

我正在阅读this book我自己，只是为了好玩，并遇到了以下问题:

This code has a security vulnerability ; Can you find and fix it? :

  bool isValidAddition(unsigned short x, unsigned short y) 
 {
     if(x + y < x)
         return false;
     else 
         return true;
 }

有人可以帮助我识别该漏洞吗？

Answer 1

我们知道，根据 C 标准，以下几点是正确的:

• sizeof(short) <= sizeof(int) <= sizeof(long)
• sizeof(short) >= 2 bytes , sizeof(int) >= 2 bytes, sizeof(long) >= 4 bytes
• There is an implicit integer promotion of operand data types used in arithmetic expressions which is done by the compiler

因此，在上面的代码片段中执行以下操作:

改变

if(x + y < x) 

到

if((unsigned short)(x + y) < x) 

如果 int 为 4(或 >2)字节，则此方法有效

希望这有帮助:)