CSC 1029: Integral Data Types and Vulnerabilities

CSC 1029: Integral Data Types and Vulnerabilities

• Course focuses on integral data types in C/C++, including signed and unsigned integers
• Discusses how integral values are stored in memory using bits
• Explores integer overflow, its causes, and consequences for both signed and unsigned types
• Covers implicit and explicit type conversions, their impact on code
• Explains casting and issues that arise when mixing signed and unsigned data types

Objectives

• Learn the fundamentals of integral types in C/C++ (signed, unsigned)
• Understand how integral values are stored in memory
• Recognize integer overflow, its triggers, and potential consequences
• Explore conversions (implicit and explicit) affecting integral types
• Understand the role of casting for signed/unsigned type conversions
• Identify potential issues with combining signed/unsigned types

Agenda (Week 10)

• Computer Integers: Overview of integral types
• Fundamental Data Types: Basic types like char, wchar_t, short int etc.
• Integers: Signed and Unsigned: Differences between signed and unsigned representations
• Integer Overflow: What happens when values exceed bounds?
• Type Conversion: Converting between integral types
• Integral Vulnerabilities: Potential issues related to overflow, and conversions
• Data Type conversion functions: Functions for converting data types
• TODO list for the week
• Resources for additional help

Why Use Data Types in C++

• Data types inform the operating system about the handled data
• Appropriate memory allocation is determined by the data type
• Variables store data at designated memory locations
• Memory allocation for variables within a function is stack-based and type-dependent

Computer Integers

• Computer integers are finite, unlike their mathematical counterparts
• Overflow or underflow can occur; it depends on CPUs and languages
• Integer calculations outside the representable range can result in unexpected behaviors (carry/overflow flag)
• Exception handling, conversions, saturation, or wrap-around can be language- or hardware-specific

C++ Fundamental Data Types

• Table providing various C++ data types (char, short int, int, long int, bool, float, double, long double, wchar_t) along with their sizes and ranges.

Sizeof Operator

• sizeof is a compile-time operator in C++ that determines the size (in bytes) of a variable or data type
• sizeof can be used for sizing arrays (based on element count)
• Pitfall: Do not use sizeof on array arguments passed into functions

Char and Wchar

• ASCII table defines 128 character codes (7 bits)
• The first 32 are control codes (non-printable); the remaining 96 represent characters like digits, letters, and symbols
• char data type represents ASCII code
• UTF-8 encoding (1-4 bytes) is used for characters outside ASCII
• wchar_t data type represents Unicode

Integral Memory Representation

• Shows the bit representation of integral data types (char, short, int)

Signed and Unsigned Types

• Every signed data type has an equivalent unsigned type
• Signed types represent positive and negative values
• Unsigned types represent only positive values (range starts from 0)
• Range for unsigned types is larger than signed types of the same bit size

Integer Overflow/Underflow

• Minimum and maximum values of data types depend on the method of representation (magnitude, sign bit, range etc.) and number of allocated bits
• Integer overflow/underflow happens when computations yield a value that's out of range for the corresponding data type

SEI CERT: Integer Wrap Prevention

• Recommendation INT30-C to avoid integer wrap-around which may lead to buffer overflows and arbitrary code execution

Integer Overflow (Discussion)

• Arithmetic overflow can cause crashes (e.g., Ariane 5 rocket failure due to steering software)
• Software relying on overflow checking and explicit type handling are considered less prone than those relying on implicit conversions

Type Conversions (C++)

• Implicit conversions occur when copying a value to a compatible type (same sign)
• Explicit conversions (type casting) are needed for conversions that might lose data or alter interpretation (e.g., different signs)

Data Type Conversion Functions

• Functions for converting std::string to integral types or vice-versa (e.g., stoi, stol, to_string)
• Avoid using non-standard itoa or ltoa functions

Pre-Work and Week 10 Content Module

• Post weekly discussion questions and research solutions on D2L
• Complete Week 10 content module in D2L to achieve 100% completion.

Questions/Clarifications/Help

• Student office hours (appointment-based and drop-in)
• Email contact information for questions
• Online tutoring resources on D2L and RRCC website

This quiz covers integral data types in C/C++, focusing on signed and unsigned integers. You'll learn about memory storage, integer overflow, type conversions, and the implications of mixing signed and unsigned values. Test your knowledge on these critical concepts relevant to programming in C/C++.