Memory Safety Remediation

// ❌ VULNERABLE: No bounds checking
void vulnerable_copy(char *input) {
    char buffer[64];
    strcpy(buffer, input);  // DANGEROUS! No length check
}

// ❌ VULNERABLE: Off-by-one error  
void off_by_one(char *input) {
    char buffer[64];
    strncpy(buffer, input, 64);  // Missing null terminator!
    // buffer[63] = '\0';  ← Forgot this!
}

// ❌ VULNERABLE: Integer overflow in allocation
void integer_overflow(size_t count) {
    size_t size = count * sizeof(int);  // Can overflow!
    int *array = malloc(size);
    // Attacker: count = 0x40000000 → size wraps to 0
}

// ✅ SECURE: Use bounded string functions
void safe_copy(const char *input) {
    char buffer[64];
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';  // Ensure null termination
}

// ✅ SECURE: Use snprintf for formatting
void safe_format(const char *name) {
    char buffer[128];
    snprintf(buffer, sizeof(buffer), "Hello, %s!", name);
    // Automatically null-terminates and checks bounds
}

// ✅ SECURE: Check for integer overflow before allocation
#include <stdint.h>
#include <limits.h>

void *safe_calloc(size_t count, size_t size) {
    if (count != 0 && size > SIZE_MAX / count) {
        return NULL;  // Would overflow
    }
    return calloc(count, size);
}

// ✅ SECURE: Use modern C functions (C11)
#define __STDC_WANT_LIB_EXT1__ 1
#include <string.h>

void modern_safe_copy(const char *input) {
    char buffer[64];
    errno_t err = strcpy_s(buffer, sizeof(buffer), input);
    if (err != 0) {
        // Handle error
    }
}

// ❌ VULNERABLE: Manual memory management
class Vulnerable {
    int *data;
public:
    Vulnerable() : data(new int[100]) {}
    ~Vulnerable() { delete[] data; }
    
    // Missing copy constructor/assignment = double-free bug!
};

// ✅ SECURE: Use smart pointers (C++11+)
#include <memory>
#include <vector>

class Safe {
    std::unique_ptr<int[]> data;  // Automatic cleanup
    std::vector<int> vec;          // Bounds-checked access
    
public:
    Safe() : data(std::make_unique<int[]>(100)), vec(100) {}
    
    // Rule of zero - compiler generates safe copy/move
    
    int get(size_t index) {
        return vec.at(index);  // Throws on out-of-bounds
    }
};

// ✅ SECURE: RAII pattern prevents leaks
class Resource {
    std::unique_ptr<FILE, decltype(&fclose)> file;
    
public:
    Resource(const char *filename) 
        : file(fopen(filename, "r"), &fclose) {
        if (!file) {
            throw std::runtime_error("Failed to open file");
        }
    }
    // File automatically closed when object destroyed
};

// ✅ Rust prevents buffer overflows at compile time
fn safe_copy(input: &str) -> String {
    let mut buffer = String::with_capacity(64);
    
    // Automatically handles bounds
    if input.len() > 64 {
        buffer.push_str(&input[..64]);  // Slicing checks bounds
    } else {
        buffer.push_str(input);
    }
    
    buffer
}

// ✅ Rust prevents use-after-free with ownership
fn ownership_prevents_uaf() {
    let data = vec![1, 2, 3];
    let reference = &data[0];
    
    // drop(data);  // ← Compile error! Can't drop while borrowed
    
    println!("{}", reference);
}

// ✅ Rust's borrow checker prevents data races
use std::sync::Arc;
use std::thread;

fn thread_safe() {
    let data = Arc::new(vec![1, 2, 3]);
    let data_clone = Arc::clone(&data);
    
    thread::spawn(move || {
        println!("{:?}", data_clone);
    });
    
    // Original data still accessible
    println!("{:?}", data);
}

// ✅ Zero-cost abstractions - no runtime overhead
fn bounds_checked(data: &[i32], index: usize) -> Option<i32> {
    data.get(index).copied()  // Returns None if out of bounds
}

// ❌ VULNERABLE: Use-after-free
void vulnerable_uaf() {
    char *ptr = malloc(100);
    strcpy(ptr, "data");
    free(ptr);
    
    // Use after free - undefined behavior!
    printf("%s\n", ptr);  // DANGEROUS
    
    // Attacker can reallocate this memory
    char *new_ptr = malloc(100);
    strcpy(new_ptr, "attacker_data");
    
    // Original pointer now points to attacker data
    printf("%s\n", ptr);  // Prints "attacker_data"
}

// ✅ SECURE: Set pointer to NULL after free
void safe_free(char **ptr) {
    if (ptr && *ptr) {
        free(*ptr);
        *ptr = NULL;  // Prevent use-after-free
    }
}

void safe_usage() {
    char *ptr = malloc(100);
    strcpy(ptr, "data");
    safe_free(&ptr);
    
    if (ptr != NULL) {  // Check is now meaningful
        printf("%s\n", ptr);
    }
}

// ✅ SECURE: Use ownership patterns
typedef struct {
    char *data;
    int refs;
} RefCounted;

RefCounted *rc_new() {
    RefCounted *rc = malloc(sizeof(RefCounted));
    rc->data = malloc(100);
    rc->refs = 1;
    return rc;
}

void rc_retain(RefCounted *rc) {
    rc->refs++;
}

void rc_release(RefCounted **rc) {
    if (rc && *rc) {
        (*rc)->refs--;
        if ((*rc)->refs == 0) {
            free((*rc)->data);
            free(*rc);
            *rc = NULL;
        }
    }
}

# ❌ Common Python memory leak: Circular references
class Node:
    def __init__(self):
        self.parent = None
        self.children = []
    
    def add_child(self, child):
        child.parent = self  # Circular reference!
        self.children.append(child)

# Memory won't be freed even after del
root = Node()
child = Node()
root.add_child(child)
del root  # Circular ref prevents cleanup

# ✅ SECURE: Use weakref to break cycles
import weakref

class SafeNode:
    def __init__(self):
        self.parent = None  # Will use weakref
        self.children = []
    
    def add_child(self, child):
        child.parent = weakref.ref(self)  # Weak reference
        self.children.append(child)
    
    def get_parent(self):
        return self.parent() if self.parent else None

# ✅ SECURE: Context managers ensure cleanup
import io

class FileHandler:
    def __init__(self, filename):
        self.file = open(filename, 'r')
    
    def __enter__(self):
        return self.file
    
    def __exit__(self, *args):
        self.file.close()  # Guaranteed cleanup

# Usage
with FileHandler('data.txt') as f:
    data = f.read()
# File automatically closed

# ✅ SECURE: Detect leaks with tracemalloc
import tracemalloc

tracemalloc.start()

# Your code here
data = [0] * (10 ** 6)

snapshot = tracemalloc.take_snapshot()
top_stats = snapshot.statistics('lineno')

for stat in top_stats[:10]:
    print(stat)

# Install Valgrind
sudo apt-get install valgrind

# Compile with debug symbols
gcc -g -O0 program.c -o program

# Run Valgrind memory checker
valgrind --leak-check=full \
         --show-leak-kinds=all \
         --track-origins=yes \
         --verbose \
         ./program

# Example output:
# ==12345== Invalid write of size 1
# ==12345==    at 0x4005C7: vulnerable_copy (program.c:42)
# ==12345==  Address 0x520104f is 1 bytes after a block of size 63 alloc'd

# Compile with AddressSanitizer
gcc -fsanitize=address -g program.c -o program
clang -fsanitize=address -g program.c -o program

# Run program - ASan will catch memory errors
./program

# Example output:
# =================================================================
# ==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000050
# READ of size 1 at 0x602000000050 thread T0
#    #0 0x4005c7 in vulnerable_copy program.c:42
#    #1 0x7ffff7a2d830 in __libc_start_main

# Compile with multiple sanitizers
gcc -fsanitize=address,undefined -g program.c -o program

# Clang Static Analyzer
scan-build make

# Cppcheck
cppcheck --enable=all program.c

# Coverity (commercial)
cov-build --dir cov-int make
cov-analyze --dir cov-int
cov-format-errors --dir cov-int

# Semgrep rules for buffer overflows
semgrep --config=p/security-audit program.c