C programmers mistakes.

[Tedd]

Ping uses part of the underlying socket support. In the ICMP (internet control message protocol) there's an ECHO command - this is all it does. You don't need any 'special' software, it's like TCP or UDP - you expect it to be there.
Of course, just to make things difficult, it could be disabled :bdg

[Mark Jones]

So Hutch, the discussion about ArgClC being possibly exploitable was a little unclear: should we be using GetCL and 128-byte strings for command-line apps?

[PBrennick]

Are you really going to trust anything he says, at this point?  He is just going to get defensive and yell at people.

Paul

[Mark Jones]

Well I hope nobody needs to get defensive or anything. :toothy

ArgClC works great; no doubt about that. It's still unclear to me exactly what is being said in this thread is all, so that's why I asked. :)

[hutch--]

Mark,

the trick is to simply check the length of the buffer supplied by GetCommandLine() before anything tries to work on the data in the buffer. A buffer overflow can only work if the data supplied is larger than an algorithms published size limit. The vast majority of command line utilities are never exposed to security threats and it is a mistake to imposed a pile of security junk when its not needed in most instances. A command line parser is a different animal to a buffer size check and a buffer size check is no more than testing for the buffer length with a zero terminated string.

I added a later version in masm32 version 9.0 called "getcl_ex" that calls the left to right argument scanner "ArgByNumber" which will handle far larger buffers than the 32k limit of a command line so if you need to track down the details of a command line based buffer overflow, it will routinely do this if you need to.

Paul Brennick,

If you want to try and snipe at me, don't do it in the Campus or it will be removed.

[PBrennick]

Okay, another time, another place.
Paul

[Mark Jones]

...and a buffer size check is no more than testing for the buffer length with a zero terminated string.

Sounds good to me, a quick & easy solution. It's hard not to be "anal" about security features in this day and age. :wink