0

I've tried searching this question, maybe because it is obvious and I've had a look at Wikipedia and OWASP

Do buffer overflows only happen when you overflow the array size or can you buffer overflow other things?

1
  • 1
    Just to be clear, by array you don't just mean a static array, right? Even arrays generated at run time can be overflowed
    – Limit
    Dec 30, 2016 at 17:41

1 Answer 1

3

Buffer overflows occur on, no surprise, buffers.

A buffer is a sequence of data. It may or may not have a distinct continuous type. On some systems it may not even consist of bytes. On the assumption that it has a maximum length (or at least an expected one) then there can occur a condition where the size of the data entering the buffer exceeds its maximum length, leading to an overflow (i.e. copy beyond the bounds). This can occur due to the buffer being of fixed length and the copied data being larger than that length, or due to a mistake in the handling of dynamic memory allocation in the case of a variable-length buffer.

Technically the buffer can be of any type. For example, memcpy'ing an int (32-bit) onto a short (16-bit) datatype is a buffer overflow - the buffer was 16 bits in size and we copied 32 bits to it, thus overflowing data onto the following 16 bits after the target buffer.

The reason we usually talk about arrays is that they're the most common data type to see in a buffer overflow context, assuming you consider a string to be a type of array (e.g. char*, which is a pointer to any number of char instances). In most cases you're going to be dealing with such a case, so it makes sense to discuss things in terms of arrays because it's a concrete programming example.

1
  • Another thing to consider is that data from a buffer is often placed on a stack that may also contain the return address for a subroutine. If a buffer overflow stomps on a return address next to it in the stack, program execution may continue from an arbitrary (attacker controlled) memory location rather than from the program that called the subroutine, allowing the attacker to then run arbitrary code. Jan 1, 2017 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .