English
Menu

What is Buffer overflow?

Writing more data into a region such as an array (a buffer) than it can hold, corrupting the adjacent memory. In C it easily happens with functions that do not know the size of the destination, such as strcpy and gets, or with loops that use indices without checking the range, and it is undefined behavior. When a buffer on the stack overflows, local variables and the function's return address can be overwritten, which can be exploited by attacks that run arbitrary code through crafted input. It is prevented with functions that take a size and with range checks.

Japanese name: バッファオーバーフロー

Buffer overflow appears in 3 practice questions across 2 topics, including Linkers, Loaders & Executables, C Programming Basics.

Field: C Programming Basics

Common causes

Typical mistakes are forgetting the 1 byte for the terminating '\0' and copying 8 characters with strcpy into char name[8], reading input with gets or scanf("%s") without checking its length, and writing one element too many, as in for (i = 0; i <= N; i++). With a function that does not receive the size of the destination, the input data decides how much is written.

Exploitation and the defenses against it

The function's return address is saved near a buffer on the stack. An attacker overwrites it with a long input and diverts execution to prepared code or to library functions. Operating systems and compilers make exploitation harder with stack protection (canaries) that checks a value placed before the return address, separation of writable and executable memory (W^X), and address randomization (ASLR).

Preventing it in programs

Instead of strcpy, use functions that take the size to write, such as snprintf, and always check input lengths and index ranges. During development, -fsanitize=address (AddressSanitizer) detects out-of-bounds writes at run time. On microcontrollers without an MMU an overflow does not stop the program right away but silently corrupts adjacent data, so particular care is needed.

Try it: questions about Buffer overflow

What is the purpose of ASLR (address space layout randomization)?

  1. ATo change the addresses of the stack, heap, libraries and so on every run, making target addresses hard for attackers to predict
  2. BTo pick memory addresses at random to raise the cache hit rate
  3. CTo free unused memory at random to increase free space
Show answer and explanation

Answer: A. To change the addresses of the stack, heap, libraries and so on every run, making target addresses hard for attackers to predict

Attacks that exploit bugs such as buffer overflows depend on knowing the addresses of library functions or data on the stack. ASLR shifts where the stack, heap, shared libraries and the executable are placed every time a process starts, so attackers cannot hard-code addresses. It is not a complete defence on its own and is combined with other measures such as separating writable and executable memory.

Which attack does W^X (never allowing a page to be both writable and executable) make harder?

  1. ATrying passwords by brute force
  2. BFlooding a server with traffic to bring it down
  3. CWriting attack machine code into a data area such as the stack and jumping to it
Show answer and explanation

Answer: C. Writing attack machine code into a data area such as the stack and jumping to it

A classic attack used a buffer overflow to write machine code onto the stack and redirect the return address to run it. CPU page tables have a no-execute bit (such as the NX bit), and if the OS makes the stack, heap and .data non-executable and .text non-writable, this method no longer works. Programs that generate code at run time, such as JIT compilers, switch between write and execute permissions.

FAQ

Does a buffer overflow always stop the program?

Not necessarily. If the excess write lands in an unused area nothing seems to happen, and if it corrupts another variable the program gives wrong results somewhere else. The program may crash only when the return address has been corrupted or when stack protection triggers.

Is strncpy safe?

strncpy copies at most the given number of characters, but when the source string is longer it does not add the terminating '\0', so later processing may read out of bounds. Use snprintf, which takes a size and always adds the terminator, or write the terminator yourself after strncpy.

Buffer overflow in the explanations

Questions that mention Buffer overflow (3)

  1. What is the purpose of ASLR (address space layout randomization)?
  2. Which attack does W^X (never allowing a page to be both writable and executable) make harder?
  3. The 8-character string "ABCDEFGH" was passed to the function save above. Which of the following is what happens?

Books on C Programming Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Stack Heap memory Return address Address space layout randomization (ASLR) Variable Alignment and padding Bit-field Dangling pointer Dynamic memory allocation Function pointer

Back to the glossary