Web 服务调用时缓冲区溢出 - 这可能吗？
我想知道无论使用何种编程语言编写服务，理论上是否可能发生 Web 服务缓冲区溢出攻击？
非常感谢
I was wondering if it was theoretically possible for a webservice buffer overflow attack irrespective of the programming language used to write the service?
Many Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您有一种编程语言在运行时检查所有缓冲区访问是否有效，那么如何会出现缓冲区溢出呢？有很多这样的语言（例如，Java）。
一个更实际的问题是，是否有任何 Web 服务是完全以这种方式（从下到上）实现的？我对此表示怀疑；大多数都是建立在操作系统之上的，通常用 C 语言编写，这也是一个弱点。您无法实际保证操作系统（或 Java 运行时）底层的机器中不存在隐藏的缓冲区溢出。
您可以做的一件事是将“无缓冲区访问检查”编程语言转换为“经过检查”的编程语言，该语言不会在不报告错误的情况下犯错误。请参阅我们的 CheckPointer，了解针对 C 编程语言执行此操作的工具。目前，该工具不适用于生产环境，因为它增加了相当多的开销。然而，还是有希望的。有些研究项目生成的程序无法访问其自身内存之外的内容，但以功能正确性/准确报告换取性能，并且这些项目的开销相当低。最终这些方法可能会在软件的较低层中使用，以确保它们也不会引起问题。
If you had a programming language that checked at runtime that all buffer accesses were valid, how could you get a buffer overflow? There are lots of langauges like this (e.g., Java).
A more practical question is, are there any web services which are implemented entirely (bottom to top) this way? I doubt it; most are built on top of an OS, usually written in C, and there's the weakness. You have no practical gaurantee that the machinery underlying your OS (or your Java runtime, for that matter) doesn't have a hidden buffer overflow in it.
One thing you can do is to convert your "no buffer access check" programming language into a "checked" one that can't make a mistake without reporting it. See our CheckPointer for a tool that does exactly this for the C programming language. At the moment, this tool isn't practical for use in a production environment because it adds rather a lot of overhead. There is hope, however; there are research projects which produce programs that can't access outside its own memory, but trade functional correctness/accurate reporting for performance, and these have pretty low overhead. Eventually these methods are likely to get used in those lower layers of software, to ensure they can't cause a problem, either.