|
|
| Line 120: |
Line 120: |
| Technical contact: [[User:Digitall|David Turner]]. | | Technical contact: [[User:Digitall|David Turner]]. |
|
| |
|
| As ScummVM is a framework housing a collection of game engines, rather than "serious" software such as a web server, operating system or cryptographic library, it is not considered security critical and thus should not be installed on servers, or other computers running critical infrastructure.
| | It would be nice to audit and improve the security of ScummVM's code, especially with respect to validation of input (e.g. configuration file, savegame and game datafile loading). |
|
| |
|
| However, we do consider security issues i.e. ScummVM does not generally require root privileges to run, Git helps harden our VCS against malicious modification, etc. We also use static analysis e.g. [http://cppcheck.sourceforge.net/ CPPCheck] and dynamic analysis e.g. [http://valgrind.org/ Valgrind] to catch programming and memory access issues which could prove exploitable. However, no one has performed a specific audit of ScummVM for security issues.
| | Apart from the ScummVM base, GUI, common and platform specific save/loading code, this would require individual work on each engine's save/load and resource loading code to assess if any issues exist and what improvements can be made without causing regressions. It would have the side effect of reducing bug reports of crashes which turn out to be due to corrupted game datafiles or savegames. |
|
| |
|
| The aim of this task would be for the student to perform this review and enhance ScummVM's code, especially with respect to validation of input, especially configuration file, savegame and game datafile loading.
| | See [[OpenTasks/Engine/Security Audit]] for more details. |
| | |
| Apart from the ScummVM base, GUI, common and platform specific save/loading code, this will require individual work on each engine's save/load and resource loading code to assess if any issues exist and what improvements can be made without causing regressions...
| |
| | |
| This task will have the side effect of reducing bug reports of crashes which turn out to be due to corrupted game datafiles or savegames.
| |
| | |
| Kudos points will be given to a student creating and submitting a binary/script patch to a supported game's datafiles which is detected normally, but results in some kind of exploit i.e. crash, infinite loop, especially if they propose a engine code patch to fix the issue which does not prevent normal games from operating correctly.
| |
| | |
| The student would require good C/C++ and communications skills. Interest or prior experience of secure programming, analysis of malware or similar would be desirable.
| |