Buffer overflow founded when migrate a c application from AIX to Solaris

[algarmon]

I migrated a c application using the cc compiler from AIX version 5 to Solaris 10.

First, I compiled my application with cc compiler using Solaris 10. I did not use special compilation options and compiled without error.
Then, I run the application and found the first buffer overflow, then corrected the application y run it again. I founded more buffer overflow in different places of the application.

A buffer overflow occurs when data written to a buffer, due to insufficient bounds checking, corrupts data values in memory addresses adjacent to the allocated buffer. Most commonly this occurs when copying strings of characters from one buffer to another.

I understand that the right thing would be to detect case by case, each of these errors and make the correction in the corresponding variable, however, the time is important.

Are there any option to compile or a pragma directive or a kernel parameter or something that makes the c application using Solaris 10 behave the same way as in cc compiler for AIX ?

Waiting for your help!

[N1GHTS]

It sounds like an unexpected hiccup during a migration plan of legacy code. Good times..

In situations like these, you have very few choices. Since the code in this case is called "not portable", you either (A) Make it portable or at least compatible with the target, or (B) Find a way to use the same tools or techniques used by the legacy software, even if it takes emulating the entire environment just to get around the problem for time's sake.

I know its not easy, It never is. And when time is money, unexpected problems like this leave you quite nervous, since whatever path you take it has to be the best value for your time.

But i'm telling you that, from experience, unless you fix the code, all you are doing is putting a bandaid on the problem, leaving it for the future, which may not be a bad thing but you get the point.

The first thing I would do is invest some time in studying the compiler options in cc (which I don't know myself). Find the manual online or use its context help if its descriptive enough. It might seem like a waste of your time but its the best possible first step.

It would help to look at the compiler used in the legacy platform and locate that same option they used, just as a reference to know what you are hunting for and know its original usage. Maybe you will be lucky and someone here will know what the option is, but don't wait up for a forum if your time is this valuable.

And if it seems like the compiler doesn't support it, find a way to use the original compiler (perhaps a new version) that can port to the new platform. If that doesn't pan out, your choices are becoming ever more painful.

Anyhow, I hope this was a help.

[algarmon]

I was reading every compiler option from AIX and Solaris compiler. I don´t find one that can solve my problem. The same story for pragma directives and kernel parameters. I didn´t find a magic alternative.

I am understanding that magic options don´t exist. And the only way is to fix the bugs, but it is an application of my client with 100,000 lines of code. My client don´t want to fix the application, because he is waiting to find a "magic" alternative to solve this problem and take to much time to fix it. Is there this magic option?

Thanks for your advice!

[N1GHTS]

Brings back memories... jeez...

Well um, have you considered some kind of emulation layer?

[algarmon]

Illuminate me!

How can I make a kind of emulation layer?

[N1GHTS]

Well, VMware comes to mind. Err.. Maybe a software emulator for AIX...

Honestly I can't think of anything since those two platforms you are using are unfamiliar to me.

But once I had to use a DOS emulator for windows called DOSBOX to migrate a software that simply wouldn't work on windows for a customer that required a computer upgrade.

So something like that I guess... Or if it exists, a hybrid emulator, like Wine on linux... I wish I could give you some specific solution between your source and target platform but I don't have any.