Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly.

It has also mentioned how certain bad programming practises involving memory can be "vulnerable to buffer overflow". It defines the buffer as:

A small amount of memory reserved for the input source

and though I've heard about buffer overflow attacks in relation to malware I have never understood what is or how it actually works, particularly from a programming perspective.

Ideally, could this be explained in "lay mans" terms as I have very little computer theory knowledge.

share|improve this question
    
You should read "Smashing the Stack for Fun and Profit": insecure.org/stf/smashstack.html –  paraxor Jun 25 '13 at 21:01

3 Answers 3

up vote 1 down vote accepted

A buffer is a pre-allocated area of memory where you store your data while you're processing it. Basically it's just saying that from a certain address in memory until memory address + x Bytes is reserved to allocate data. In C this is often called an array.

A buffer overflow happens when you assign more data than can fit into the buffer and overwriting the code beyond memory address + x. You might have done this before and you will notice that your program crashes. Now the problem is that somewhere beyond your buffer is the return address (this is pointing to the next instruction that will be executed after assigning the buffer and loading the data into it) and if you overwrite it with random data your program will crash. However if you manage to load byte code (this is a compiled program which the CPU can directly execute) and you can actually make it point to your program, then you can execute code on that machine.

Now you might think that this is not really an issue if you are running it locally, but imagine programs like SSH or FTP servers which run on the internet or imagine a restricted environment where certain programs run with elevated privileges. If you were able to execute code within the context and privileges of the other program, you could be able to break out of your restrictions or take over a remote server.

If you want to know more about assembly, bufferoverflows and shellcode, I suggest buying the Shellcoder's Handbook. It's THE book to learn this stuff.

share|improve this answer

As you wrote a buffer s a small amount of memory (e.g. 16 bytes). When I now write more bytes into the buffer (e.g. 20 bytes) than its capacity this is called buffer overflow.

If the data in the buffer comes from the outside this is a security flaw as the new bytes are written in a memory area which is used for other purposes.

When the other purpose of the overwriten bytes was to contain program code you an imagine what happens then.

share|improve this answer

In C, buffer overflows most commonly happen when data copied into an array(buffer) exceeds its defined size. This explains it perfectly. Just read the C code there if you're not familiar with assembly

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.