[入門] C/C++コードを10倍安全にする 未定義動作を防ぐ実践テクニック #C++ – Qiita

// test_array_bounds.c
#include 
#include 

void demonstrate_off_by_one() {
    int array[5] = {1, 2, 3, 4, 5};
    
    printf("Valid access:\n");
    for (int i = 0; i  5; i++) {
        printf("array[%d] = %d\n", i, array[i]);
    }
    
    printf("\nOff-by-one error:\n");
    for (int i = 0; i  5; i++) {  // バグ：
        printf("array[%d] = %d\n", i, array[i]);
    }
}

int main() {
    demonstrate_off_by_one();
    return 0;
}

gcc -fsanitize=address -fno-omit-frame-pointer -g test_array_bounds.c -o test_array_bounds
./test_array_bounds

Valid access:
array[0] = 1
array[1] = 2
array[2] = 3
array[3] = 4
array[4] = 5

Off-by-one error:
array[0] = 1
array[1] = 2
array[2] = 3
array[3] = 4
array[4] = 5
=================================================================
==12345==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd12345694
READ of size 4 at 0x7ffd12345694 thread T0
    #0 0x555555555234 in demonstrate_off_by_one test_array_bounds.c:14
    #1 0x555555555345 in main test_array_bounds.c:19

Address 0x7ffd12345694 is located in stack of thread T0 at offset 52 in frame
    #0 0x555555555123 in demonstrate_off_by_one test_array_bounds.c:5

  This frame has 1 object(s):
    [32, 52) 'array' 

// test_safe_array.c
#include 
#include 
#include 
#include 

typedef struct {
    int* data;
    size_t size;
} SafeArray;

bool safe_array_set(SafeArray* arr, size_t index, int value) {
    if (!arr || !arr->data || index >= arr->size) {
        return false;
    }
    arr->data[index] = value;
    return true;
}

int safe_array_get(const SafeArray* arr, size_t index, int default_value) {
    if (!arr || !arr->data || index >= arr->size) {
        return default_value;
    }
    return arr->data[index];
}

int main() {
    const size_t size = 1000;
    const int iterations = 10000000;
    
    // 配列の準備
    int* raw_array = malloc(size * sizeof(int));
    SafeArray safe_arr = {raw_array, size};
    
    clock_t start, end;
    
    // 通常のアクセス
    start = clock();
    for (int iter = 0; iter  iterations; iter++) {
        for (size_t i = 0; i  size; i++) {
            raw_array[i] = i;
        }
    }
    end = clock();
    printf("Raw array access: %.4f seconds\n", 
           ((double)(end - start)) / CLOCKS_PER_SEC);
    
    // SafeArrayを使用
    start = clock();
    for (int iter = 0; iter  iterations; iter++) {
        for (size_t i = 0; i  size; i++) {
            safe_array_set(&safe_arr, i, i);
        }
    }
    end = clock();
    printf("Safe array access: %.4f seconds\n", 
           ((double)(end - start)) / CLOCKS_PER_SEC);
    
    // 境界外アクセスのテスト
    printf("\nBoundary test:\n");
    printf("Setting index 999: %s\n", 
           safe_array_set(&safe_arr, 999, 42) ? "Success" : "Failed");
    printf("Setting index 1000: %s\n", 
           safe_array_set(&safe_arr, 1000, 42) ? "Success" : "Failed");
    
    free(raw_array);
    return 0;
}

gcc -O2 test_safe_array.c -o test_safe_array
./test_safe_array

# スタック保護機能を有効にしてコンパイル
gcc -fstack-protector-strong -O2 test_array_bounds.c -o test_stack_protected

# FORTIFY_SOURCEを有効にしてコンパイル（文字列関数などの境界チェック）
gcc -D_FORTIFY_SOURCE=2 -O2 test_array_bounds.c -o test_fortified

# 全ての保護機能を有効にしてコンパイル
gcc -fstack-protector-strong \
    -D_FORTIFY_SOURCE=2 \
    -Wformat -Wformat-security \
    -fPIE -pie \
    -O2 test_array_bounds.c -o test_fully_protected