Slide Set 3. for ENCM 339 Fall 2017 Section 01. Steve Norman, PhD, PEng

Transcription

1 Slide Set 3 for ENCM 339 Fall 2017 Section 01 Steve Norman, PhD, PEng Electrical & Computer Engineering Schulich School of Engineering University of Calgary September 2017

2 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 2/45 Contents Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

3 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 3/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

4 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 4/45 Arrays in C In many programming languages, an array is a collection of data objects called elements, such that all the elements have the same type; an individual element within an array is selected using an integer expression called an index. In C, arrays are very closely connected to pointers. That s not true in most other programming languages!

5 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 5/45 Syntax for declaring an array variable in C For an array element type such as int, double, or char, here is how to declare a C array variable: type identifier [ integer expression ] ; The integer expression specifies the number of elements in the array. In earlier versions of C, it had to be a constant, but as of the 1999 C standard, it can involve variables and function parameters. In examples in ENCM 339 lectures, the number of elements will be a simple constant.

6 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 6/45 An example array variable This declares x to be an array of 5 ints: int x[5]; Let s make a sketch of x, and make some remarks. (Among the remarks: Indexing starts at zero.)

7 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 7/45 When programming in C, don t try to use Processing syntax! This is how to create an array of 5 int elements in Processing: int[ ] a = new int[5]; That won t work at all in C!

8 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 8/45 Index range checking Consider this Processing code fragment: int[ ] a = new int[5]; int i; // Valid indexes are 0, 1, 2, 3, 4, but not 5. for (i = 0; i <= 5; i++) a[i] = 10 * (i + 1); An attempt to run the code will result in program termination with this error message: ArrayIndexOutOfBoundsException: 5 Let s make some notes about what happens before the error occurs, and about what causes the error.

9 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 9/45 What happens with a C array? int a[5]; int i; // Valid indexes are 0, 1, 2, 3, 4, but not 5. for (i = 0; i <= 5; i++) a[i] = 10 * (i + 1); Let s make some notes about what might happen here. The fact that things might work even though they shouldn t work is not a good thing about C!

10 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 10/45 C arrays and C++ vectors C programmers use array types where most current C++ programmers would use vector types. C++ vector types are generally safer than C array types, but do not exist in plain C. Here are some weaknesses of C array types relative to C++ vector types: Once a C array has been created, it cannot be resized there is no way to grow or shrink an array. With C arrays, it is usually impossible to ask for index range checking. If you ever need to do any C++ programming, be sure to learn how to use C++ vector types.

11 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 11/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

12 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 12/45 Brief notes about the Standard C Library In programming, a library is a collection of functions and types that is installed as part of a programming system. Programmers can use these function and types without having to define them. Some of the functions in the Processing core library are ellipse and line, used to draw things, and print and println, used to write text to the Processing Console. The Standard C Library is the set of library functions, types, and related facilities that is available on every standard-compliant implementation of C. Most C implementations also offer lots of other library features beyond what is mandated by C standards.

13 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 13/45 Standard C Library Header Files Library facilities can be roughly split into categories associated with library header files files that contain lists of function prototypes, type declarations, and other related information. Header files are sometimes just called headers. Chapters 16 and 17 of C in a Nutshell (second edition), our course C textbook, list all the Standard C Library headers and summarize their contents. The next few slides say a few things about some of the most-often-used library headers.

14 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 14/45 <stdio.h> std is short for standard, and io is short for input/output. printf and scanf are just two of the many input/output functions associated with <stdio.h>. Later in the course, we ll learn about types and functions that can be used to do input and output with files, instead of with a terminal window.

15 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 15/45 <stdlib.h> std is short for standard, and lib is short for library. The name is confusing. <stdlib.h> provides information only about part of the Standard C Library, not the whole Standard C Library. Some of the many associated functions are exit, for forcing program termination; malloc and free, for managing dynamically allocated memory, as we ll see later in the course.

16 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 16/45 <math.h> Here are a few of the many math functions... sqrt sin cos asin acos log log10 Each of the above has one parameter, of type double, and a return type of double. sqrt is short for square root. All functions related to trigonometry assume that angles are given in radians. This function is used to find the best approximation to x raised to the power y... double pow(double x, double y); For example, what would the value of pow(0.5, 3.0) be?

17 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 17/45 <string.h> <string.h> are used to manipulate and answer questions about character strings, as we ll soon see.

18 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 18/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

19 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 19/45 Character strings in C A string is a sequence of character codes stored in an array of char elements; the sequence is terminated by a null character. Let s demonstrate this, using a somewhat awkward way to set up a string. Important: The character constant for the null character is \0, and the value of the null character in ASCII is zero. Let s describe the algorithm used by printf when it prints a string in a response to a %s specification. Let s make diagrams for points (1) and (2) in our example program, assuming that the character set in use is ASCII.

20 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 20/45 Notes on null termination 1. \0 is backslash zero, not backslash oh. 2. Terminating a string with \0 is mandatory. printf and most other string-handling functions have no other way of knowing where a string ends. 3. A string N characters in length needs at least N + 1 array elements of type char for storage. It s okay for arrays of char containing strings to be larger than necessary. 4. Null termination is used only with character strings, not with arrays that have elements of type int, double, etc.

21 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 21/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

22 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 22/45 The strcpy function and related C concepts Usually programmers don t set up C strings by assigning one char at a time. A more common method is use of the strcpy ( string copy ) function in the standard library. Let s look at the example on the next slide.

23 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 23/45 #include <stdio.h> #include <string.h> // library header file // for string functions int main(void) { char s[6]; strcpy(s, "foo"); // (1) printf("begin%send\n", s); return 0; } What will be in the array s at point (1)? What will be the output of the program?

24 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 24/45 The function prototype for strcpy char * strcpy(char *dest, const char *src); dest has type pointer-to-char. src has type pointer-to-const-char. In the call to strcpy in main on the previous slide, the argument types match the types in the function prototype. For C beginners, these type matches are not at all obvious. Let s make a short list of things that need to be explained.

25 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 25/45 An array name often generates a pointer In C and C++, in most expressions, the name of an array gets treated as the address of element 0 of the array. For example, strcpy(s, "foo"); really means strcpy(&s[0], "foo"); That is not obvious. If you are new to C, you can t know that by reading the code you need to have it explained to you! That s really means &s[0] in this context reflects an important design decision made when C was first created.

26 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 26/45 String constants usually generate pointers This was another important C language design decision. A string constant occupies an array of chars located in a region of program memory we will call static storage. In this example... strcpy(s, "foo");... the second argument is actually the address of the f character at the beginning of an array in static storage. (There s an exception to this rule: String constants used as initializers for arrays of chars do not generate addresses. We ll worry about that later.)

27 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 27/45 A definition for strcpy To illustrate concepts introduced the last several slides, let s pretend that strcpy is not provided in the C library, and that we have to supply our own definition. To understand where the arrays are and which addresses go into the parameters of strcpy, let s make a diagram for point (1) on the next slide. Then let s complete the definition of strcpy, and make some notes about how it will work.

28 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 28/45 char *strcpy(char *dest, const char *src) { int i; // (1) } // Need some code here! int main(void) { char s[6]; strcpy(s, "hello"); return 0; }

29 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 29/45 Use of square brackets and indexes with pointers The definition of strcpy involved expressions such as src[i] and dest[i]. Why do these expressions make sense? What do they really mean? Let s make some notes.

30 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 30/45 The return value of strcpy Understanding how strcpy uses its parameters is really, really important! In contrast, the return value from strcpy is a minor detail. strcpy returns the address of the beginning of the destination array. That allows nested calls, such as in this fragment: char a[5], b[5]; strcpy(b, strcpy(a, "ENCM")); The string constant is copied into the array a, and then the string is copied from array a into array b. In the vast majority of calls to strcpy, the return value is not used.

31 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 31/45 Use of const with pointers Consider this example: void f(const int *p, int n) { code } Here, f is not allowed to change the value of any int it might access through the pointer p. Let s add some detail to this explanation.

32 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 32/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

33 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 33/45 Function parameters declared to be arrays are really pointers! This is yet another non-obvious aspect of the array/pointer relationship. Let s look at the code on the next slide, and make some diagrams and some remarks.

34 double average(const double y[ ], int n); int main(void) { double x[ ] = { 1.1, 1.2, 1.6 }, avg; avg = average(x, 3); return 0; } double average(const double y[ ], int n) { double sum = 0.0; int i; for (i = 0; i < n; i++) sum += y[i]; // (1) (After the for loop is done.) } return sum / n;

35 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 35/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

36 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 36/45 Buffer overflows Here is a definition for strcpy, seen previously... char * strcpy(char *dest, const char *src) { int i; for (i = 0; src[i]!= \0 ; i++) dest[i] = src[i]; dest[i] = \0 ; return dest; } What will happen if the destination array is not big enough to hold the source string?

37 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 37/45 Buffer is an informal term often used to mean array of chars used to hold some program input. The C library function gets ( get string ) which you should NEVER USE is completely defenseless against buffer overflows... #include <stdio.h> int main(void) { char name[8]; printf("hi, what is your name?\n"); gets(name); printf("nice to meet you, %s.\n", name); return 0; } Let s make some notes about what this program might do.

38 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 38/45 How bad are buffer overflows? In a small program that only you and perhaps a few trusted co-workers use... Buffer overflows can cause mysterious program crashes or wrong program output. In a program that lets untrustworthy users provide input, such as software running on a Web server... BUFFER OVERFLOWS CAN BE EXTREMELY BAD. Sometimes an attacker can carefully craft a too-long input string that lets the attacker break in and take over a computer! (How this works is not an ENCM 339 topic, but there are lots of articles about it on the Web.)

39 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 39/45 Avoiding buffer overflows in small C programs Write code that can detect potential buffer overflows before they happen. To do this, you must carefully read documentation of library functions, and carefully think about string-handling functions you write yourself. Example DOs and DON Ts: Don t use strcpy (or the related strcat function) unless you are certain about all of the array sizes and possible string lengths in a program. Do use safer functions for copying strings. Don t use gets to read a line of input text. Do use fgets, which is safer. Do make a plan for what a program should do if an array is too small for an input string shutting down with an error message is often a good choice.

40 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 40/45 Avoiding buffer overflows in production code If software you re developing must defend itself against attackers, your development team needs experts on computer security. That level of expertise is well beyond what can be taught in a course like ENCM 339.

41 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 41/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

42 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 42/45 One more array programming exercise Consider writing a function to compute the average value of an array of ints. What should the parameter type(s) and the return type be? Let s write a function prototype and function interface comment. Let s write a function definition. Let s write down some remarks about what the function should do if the REQUIRES conditions in the function are not satisfied. (Reminder: There is a link to document on function interface comments on the course Lab Information page. You should read thhat document carefully, probably more than once!)

43 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 43/45 Outline of Slide Set 3 Arrays in C Brief notes about the Standard C Library Character strings in C The strcpy function and related C concepts Function parameters declared to be arrays are really pointers! Buffer overflows One more array programming exercise So many weird rules! Why can t we just write cool programs?

44 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 44/45 So many weird rules! Why can t we just write cool programs? Some (not all of) the things you ve learned so far in ENCM 339: an AR model for storage of function parameters and local variables; the fact that there are a bunch of messy rules about conversion back and forth between char and int; a model of memory as a giant array of bytes; it s important to know exactly what the unary & and * operators do; the name of an array usually turns into a pointer when that name is used in an expression.

45 ENCM 339 Fall 2017 Section 01 Slide Set 3 slide 45/45 In Labs 1 and 2, you ve used your knowledge to draw diagrams with lots of AR s; to complete C programs that do things any ENGG student could do in about 30 seconds with a pencil, a piece of paper, and a very cheap calculator. Please trust me. We re making progress, both short-term and long-term. Short-term goal: Ability to succeed in ENCM 339, ENCM 369, and other courses. Long-term goal: Ability to read and understand the source code for much of the most important and/or commerciallysuccessful software in the world, software that is mostly still in active development.