Questions tagged [buffer-overflow]

Usually occurs when you attempt to copy data into a buffer without checking for sufficient space, causing data to be overwritten in neighboring cells.

RAM is divided into memory cells with each cell capable of storing a single byte on it's own. Applications use different sizes of the same data type to fulfill their computational needs, which can vary between a single or multiple (arrays) or dynamically allocated (pointers). Problems usually arise when software developers employ the use of arrays or pointers without verifying the destination buffer has sufficient or adequate space.

char Target[10];
char Input[20];
strcpy( Target, Input); // 1st Parameter: Destination, 2nd Parameter: Data

The code listed above plus certain conditions can exhibit the buffer-overflow corruption. If the coder doesn't take the necessary precautions to validate target/input, it will result in data being fed into adjacent memory cells corrupting whatever contents is stored within them.

Such results can be devastating as they affect overall system integrity.

1483 questions
12
votes
3 answers

Is buffer overflow/overrun possible in completely managed asp.net c# web application

Can there be buffer overflow/overrun vulnerabilities in completely managed asp.net web portal.If yes how can this be tested.
Pradeep Kumar Mishra
  • 10,839
  • 4
  • 25
  • 26
12
votes
5 answers

How to determine the size of an allocated C buffer?

I have a buffer and want to do a test to see if the buffer has sufficient capacity I.e. find number of elements I can add to the buffer. char *buffer = (char *)malloc(sizeof(char) * 10); Doing a int numElements = sizeof(buffer); does not return…
godzilla
  • 3,005
  • 7
  • 44
  • 60
10
votes
4 answers

Difference between - buffer overflow and return to libc attack

I want to comprehend the exact difference between these two types of attack. From what I have read: Buffer Overflow: It overwrites the ret address on the stack to point to another section of the code where the malicious code is inserted. So…
Hari
  • 5,057
  • 9
  • 41
  • 51
10
votes
1 answer

exploiting Buffer Overflow using gets() in a simple C program

I am new to Buffer Overflow exploits and I started with a simple C program. Code #include #include void execs(void){ printf("yay!!"); } void return_input (void) { char array[30]; gets(array); } int main() { …
Panther Coder
  • 1,058
  • 1
  • 16
  • 43
10
votes
0 answers

Python is reading past the end of the file. Is this a security risk?

So I just noticed this, and after some experimentation, I managed to make it reproducible. I didn't see this posted anywhere. Python seems to be reading past the end of files in certain circumstances. I'm using Python 2.7.12 f = open('test',…
Daffy
  • 841
  • 9
  • 23
10
votes
3 answers

Is gcc reordering local variables at compilation time?

I'm currently reading (for the second time) "Hacking : The Art of Exploitation" and have stumbled on something. The book suggests two different ways to exploit these two similar programs : auth_overflow and auth_overflow2 In the first one, there is…
rgehan
  • 315
  • 1
  • 14
10
votes
4 answers

gdb showing different address than in code

I am trying to implement a buffer overflow attack and I need to know the address of my buffer that I am trying to overflow. The address that is displayed using GDB is different than if I just did this in the code: Exact code: #include int…
Kingamere
  • 9,496
  • 23
  • 71
  • 110
10
votes
7 answers

What's a buffer?

As far as my understanding of languages goes, a buffer is any portion of memory in which a data is stored like an int,float variables, character arrays etc. However, I was reading buffer overflows and came across this link while reading about stack…
Naruto
  • 155
  • 5
10
votes
2 answers

How does Visual Studio 2013 detect buffer overrun

Visual Studio 2013 C++ projects have a /GS switch to enable buffer security check validation at runtime. We are encountering many more STATUS_STACK_BUFFER_OVERRUN errors since upgrading to VS 2013, and suspect it has something to do with improved…
BlueMonkMN
  • 25,079
  • 9
  • 80
  • 146
10
votes
4 answers

GCC how to detect stack buffer overflow

Since there is an option -fstack-protector-strong in gcc to detect stack smashing. However, it can not always detect stack buffer overflow. For the first function func, when I input a 10 char more string, the program does not always crash. My…
Michael D
  • 1,449
  • 5
  • 18
  • 31
10
votes
2 answers

How to disable buffer overflow checking in the Visual C++ Runtime?

i, and a few thousand other people, are getting an error being thrown by the Microsoft Visual C++ Runtime: Which for the benefit of search engines, says: Microsoft Visual C++ Runtime Library Buffer overrun detected! Program: %s A buffer overrun…
Ian Boyd
  • 246,734
  • 253
  • 869
  • 1,219
10
votes
2 answers

Why is the fgets function deprecated?

From The GNU C Programming Tutorial: The fgets ("file get string") function is similar to the gets function. This function is deprecated -- that means it is obsolete and it is strongly suggested you do not use it -- because it is dangerous.…
Vilhelm Gray
  • 11,516
  • 10
  • 61
  • 114
10
votes
3 answers

boost::asio::buffer: Getting the buffer size and preventing buffer overflow?

I have the two following functions for sending and receiving packets. void send(std::string protocol) { char *request=new char[protocol.size()+1]; request[protocol.size()] = 0; memcpy(request,protocol.c_str(),protocol.size()); …
pandoragami
  • 5,387
  • 15
  • 68
  • 116
10
votes
3 answers

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are there performance concerns or other issues that…
rook
  • 66,304
  • 38
  • 162
  • 239
9
votes
5 answers

Why I do get "Cannot find bound of current function" when I overwrite the ret address of a vulnerable program?

I want to exploit a stack based buffer overflow for education purposes. There is a typical function called with a parameter from main, which is given as input from the program a local buffer where the parameter is saved. Given an input such that…
curious
  • 1,524
  • 6
  • 21
  • 45