03 07 17 1

Page 1

Computer Security Exam Professors F. Maggi & S. Zanero Milan, 03/07/2017 Last (family) Name ____________________________ First (given) Name ____________________________ Matricola or Codice Persona ____________________________ Have you done any challenges/homework, even partially? [ ] Yes [ ] No Instructions ● The exam is composed of 10 pages. Check that you have all of them ● Just as a cross check, tell us whether you have completed the homeworks, by putting an "X" mark appropriately. ● The exam is "closed books". Please put away in a non-suspicious place (i.e. not below the desk) any note, book, or similar. You will be expelled if, at any time, if you do not follow this rule. ● You are not allowed to communicate with other students, and you will be expelled from the exam if you do. ● Shut down and store electronic devices. They will be subject to inspection if found and you may be expelled if you are found using one. ● Please answer within the allowed space. Schemes are good, short answers are recommended. ● You can write in pen or pencil, any color, but ​ avoid writing in red ​ . ● No extra paper is allowed. ● The answers should be written exclusively in the space provided below the questions. SOLUTION Answer provided in this solution MUST BE CONSIDERED ONLY AS A HINT for the correct answer, and they are not necessarily complete. Page 1 of 10 Computer Security Exam - 03/07/2017 - Professors F. Maggi & S. Zanero Question 1 (9 points) Consider the C program below, which is affected by a typical buffer overflow vulnerability. #include <stdio.h> #include <stdlib.h> #include <string.h> int vuln(int n, int param) { ​ int x = 0xdeadbeef; char buffer[20]; if(n < 2 || param > 10) { ← --- here scanf("%s", buffer); if(strcmp(buffer, "sesame") == 0) { doSomething(); // not…