Is the code susceptible to buffer overruns?
Buffer overruns are a vulnerability that may lead to execution of arbitrary code. While tracing through unmanaged or unsafe code, make sure that the following rules are followed: • Make sure any functions that copy variable-length data into a buffer and use a maximum length parameter properly. • Make sure that the code does not rely on another layer or tier for data truncation. • If you see a problem, make sure the code truncates the data instead of expanding the buffer to fit it. Buffer expansion may just move the problem downstream. • Make sure any unmanaged code was compiled with the /GS option. The application should not contain code similar to the following example.
