Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is that possible to make software which is not vulnerable to any type of buffer overflow? For example, a software that receives data packets and transfers it to destination after data analysis.

share|improve this question

1 Answer 1

It depends on what you call buffer overflow.

It is possible and easy to make software which never writes outside of a buffer. All it takes is a programming language which checks array bounds, e.g. Python, Java, C#, VB, Pascal, Ruby... in fact almost any language except C, C++, Forth and Assembly. In a language which checks array bounds, any attempt at overflowing a buffer triggers an error condition (e.g. an exception is thrown) which prevents the unwanted memory write.

It is difficult to make software which never attempts at writing outside a buffer. The bounds checking prevents the buffer from truly overflowing, but the code is still trying to do something which does not make sense, and that's a bug. Not allowing the write to happen is good, but the thread/process still crashes (it turns a remote shell exploit into a denial of service, which is better, but not good). Writing bug-free code is theoretically feasible, but it never happens in practice (the only application which is reputed truly bug-free is Knuth's Metafont).

There are a lot of people who work on the concept of proving correctness of code. In a rather strong sense (see the halting problem), it is not possible to make a generic correctness prover, but one can hope that a few hints added in the source code could help an automatic prover. This means using some specific languages which allow for this sort of things to happen (e.g. Esterel or Eiffel). As far as I know, a programmer who thinks a lot is still needed in the process. It has been said that NASA pays quite a lot for having software without bugs (I heard around 20000$ per line of code !) and yet this is not guaranteed (when Apollo 11 landed on the Moon, the on-board computer crashed, and Armstrong had to do the landing manually, in true Hollywood fashion).

share|improve this answer
    
is that possible a basic code that do not execute received data be vulnerable to buffer overflow ? or to perform buffer overflow, target software must execute data ? –  pier Sep 30 '12 at 15:53
    
"All it takes is a programming language which checks array bounds". If only that were so. The problem is that these programing languages may themselves contain buffer overflows which an evil doer could exploit. Just look at the problems Java has had just over the last few months. –  Jim In Texas Oct 1 '12 at 5:22
    
@pier - Your question makes no sense. –  Ramhound Oct 2 '12 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.