Questions tagged [buffer-overflow]

Usually occurs when you attempt to copy data into a buffer without checking for sufficient space, causing data to be overwritten in neighboring cells.

RAM is divided into memory cells with each cell capable of storing a single byte on it's own. Applications use different sizes of the same data type to fulfill their computational needs, which can vary between a single or multiple (arrays) or dynamically allocated (pointers). Problems usually arise when software developers employ the use of arrays or pointers without verifying the destination buffer has sufficient or adequate space.

char Target[10];
char Input[20];
strcpy( Target, Input); // 1st Parameter: Destination, 2nd Parameter: Data

The code listed above plus certain conditions can exhibit the buffer-overflow corruption. If the coder doesn't take the necessary precautions to validate target/input, it will result in data being fed into adjacent memory cells corrupting whatever contents is stored within them.

Such results can be devastating as they affect overall system integrity.

1483 questions
31
votes
12 answers

What is a buffer overflow and how do I cause one?

I have heard about a buffer overflow and I would like to know how to cause one. Can someone show me a small buffer overflow example? New(And what they are used for?)
H4cKL0rD
  • 5,421
  • 15
  • 53
  • 74
26
votes
5 answers

Stack Smashing attempt giving segfault

I am trying to do an example from the Smashing the Stack for Fun and Profit in C, but am kind of stuck at a point, following is the code (I have a 64-bit machine with Ubuntu 64-bit): int main() { int x; x = 0; func(1,2,3); x = 1; …
user60103
  • 321
  • 4
  • 6
25
votes
14 answers

What C/C++ tools can check for buffer overflows?

I've been asked to maintain a large C++ codebase full of memory leaks. While poking around, I found out that we have a lot of buffer overflows that lead to the leaks (how it got this bad, I don't ever want to know). I've decided to removing the…
MrValdez
  • 8,515
  • 10
  • 56
  • 79
25
votes
7 answers

If your stack and heap are non-executable, how can your code run?

I read a book about buffer overflow, and it suggest the next to deal with: Making the stack (and heap) non-executable provides a high degree of protection against many types of buffer overflow attacks for existing programs. But I don't…
Adam Sh
  • 8,137
  • 22
  • 60
  • 75
23
votes
1 answer

Why do I get access violations when a control's class name is very, very long?

I subclassed a control in order so I can add a few fields that I need, but now when I create it at runtime I get an Access Violation. Unfortunately this Access Violation doesn't happen at the place where I'm creating the control, and even those I'm…
Cosmin Prund
  • 25,498
  • 2
  • 60
  • 104
22
votes
2 answers

return to lib_c buffer overflow exercise issue

I'm supposed to come up with a program that exploits the "return to libc buffer overflow". This is, when executed, it cleanly exits and brings up a SHELL prompt. The program is executed in a bash terminal. Below is my C code: #include…
lightningmanic
  • 2,025
  • 5
  • 20
  • 41
21
votes
6 answers

Is sscanf considered safe to use?

I have vague memories of suggestions that sscanf was bad. I know it won't overflow buffers if I use the field width specifier, so is my memory just playing tricks with me?
nmichaels
  • 49,466
  • 12
  • 107
  • 135
20
votes
4 answers

Buffer Overflow Attack

I'm trying to execute a very simple buffer overflow attack. I'm pretty much a newbie to this. So, if this question is stupid, please excuse me :-) The code: #include #include int i, n; void confused(int i) { printf("**Who…
Ashwin
  • 873
  • 2
  • 12
  • 21
20
votes
11 answers

Consequences of this buffer overflow?

So here I believe I have a small buffer overflow problem I found when reviewing someone else's code. It immediately struck me as incorrect, and potentially dangerous, but admittedly I couldn't explain the ACTUAL consequences of this "mistake", if…
KevenK
  • 2,975
  • 3
  • 26
  • 33
19
votes
1 answer

Heap overflow attacks

How are heap overflow attacks executed? In the case of stack overflow attacks, the attacker replaces the function return address with his address of choice. How is this done in the case of a heap overflow attack? Also, is it possible to run code…
chappar
  • 7,275
  • 12
  • 44
  • 57
19
votes
5 answers

Buffer overflow in C

I'm attempting to write a simple buffer overflow using C on Mac OS X 10.6 64-bit. Here's the concept: void function() { char buffer[64]; buffer[offset] += 7; // i'm not sure how large offset needs to be, or if …
ryyst
  • 9,563
  • 18
  • 70
  • 97
19
votes
5 answers

How are buffer overflows used to exploit computers?

How are buffer overflows used to exploit computers? How is one able to execute arbitrary code simply by causing stack or heap overflows? I understand that portions of the programs memory are overwritten that aren't supposed to be, but I don't see…
anon
19
votes
2 answers

Shellcode for a simple stack overflow: Exploited program with shell terminates directly after execve("/bin/sh")

I played around with buffer overflows on Linux (amd64) and tried exploiting a simple program, but it failed. I disabled the security features (address space layout randomization with sysctl -w kernel.randomize_va_space=0 and nx bit in the bios). It…
henning
  • 193
  • 1
  • 1
  • 5
18
votes
11 answers

What C/C++ functions are most often used incorrectly and can lead to buffer overflows?

I've been asked to maintain a large C++ codebase full of memory leaks. While poking around, I found out that we have a lot of buffer overflows that lead to the leaks (how it got this bad, I don't ever want to know). I've decided to removing the…
MrValdez
  • 8,515
  • 10
  • 56
  • 79
18
votes
5 answers

Why is "long" being allowed as array length in C#?

I wanted to try to allocate a 4 billion bytes array and this is my C# code: long size = 4 * 1000; size *= 1000; size *= 1000; byte[] array = new byte[size]; this code fails with System.OverflowException on the line containing new. Okay, turns out…
sharptooth
  • 167,383
  • 100
  • 513
  • 979
1
2
3
98 99