Investigating the Input Validation Vulnerabilities in C Programs

Input validation is a fairly universal programming practice that helps reduce the chances of producing protection-related vulnerabilities in software. In this paper, an experiment is conducted to specifically determine the input validation issues found in programs and the problematic functions that lead to such issues. The experiment evaluated 12 arbitrarily selected open source C projects written by different programmers. The top two most common input validation problems are buffer overflow/XSS and potential memory mismanagement. In addition, the functions that caused the first problem are (a) strings/text functions (e.g., strcpy and strcmp), and (b) functions that read from standard input, STDIN (e.g., scanf and gets). In contrast, the functions that caused the second problem are (a) memory allocation/deallocation functions (e.g., memmove and malloc), and (b) file manipulation functions (e.g., fopen and fseek). Furthermore, the goto construct—to a small extent—plays a role. The recommendations are that (a) developers are encouraged to use memory-safe programming languages, otherwise, they should perform different types of checks for the validity of inputs as soon as they are entered, and (b) they should have the required knowledge of secure source code and use tools/suites to manage malformed strings.

@article{Ebad2023,
  title     = {Investigating the Input Validation Vulnerabilities in C Programs},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {14},
  number    = {1},
  year      = {2023},
  publisher = {The Science and Information Organization},
  author    = {Shouki A. Ebad},
  doi       = {10.14569/IJACSA.2023.0140117},
  url       = {https://doi.org/10.14569/IJACSA.2023.0140117}
}