← ACARA Digital Technologies Years 9–10

Buffer overflow

When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 59, WA Computer Science ATAR Year 11 — Cyber Security — Module 53

Understanding Buffer overflow in ACARA Digital Technologies Years 9–10

What it does: A segmentation fault is a common crash message when a program touches memory it should not, such as after an overflow. The long run of filler fills the buffer and spills over, and the attacker's code lands in memory where the program may run it. The extra 12 characters spill into nearby memory and overwrite it. That is a buffer overflow. Input validation stops oversized data from ever being written into the buffer. The text is longer than the 8-character buffer, and strcpy does not check the length, so this is a buffer overflow.

Common mistakes: name only holds 8 bytes, but this copies up to 20 bytes into it. The extra bytes overflow into nearby memory. The copy length should match the buffer size: strncpy(name, input, 8);. The word has 6 letters but the buffer only has 3 slots, so the extra letters would overwrite nearby memory. The buffer needs to be big enough: array of 6 slots.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Buffer overflow to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A program has a buffer that holds 8 characters. A user types 20 characters and the program saves them all without checking. What is this?
A buffer overflowA normal save
Matches
char buf[4]; gets(buf); // no length check
↓
gets() reads any amount of input with no size limit, so long input overflows the 4-character buffer. Use fgets(buf, 4, stdin) instead.
Applying
Meanings
Term
buffer overflow
Meaning
When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.
Practice
buffer ← array of 8 characters
Testing
Gaps
name[8];
Check Answer
Spots
2char input[20];
3strncpy(name, input, 20);

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Reindeer' badge — Dictionary Guide, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A program has a buffer that holds 8 characters. A user types 20 characters and the program saves them all without checking. What is this?
A. A buffer overflow ✓
B. A normal save
The extra 12 characters spill into nearby memory and overwrite it. That is a buffer overflow.
2. What does a buffer overflow overwrite?
A. Nearby memory next to the buffer ✓
B. Only the buffer's own memory
The data is too big for the buffer, so the extra spills past its edge into the memory beside it.
3. Which is the simplest result of a buffer overflow?
A. The program gets faster
B. The program crashes ✓
Overwriting nearby memory can corrupt the program's own data and make it crash.
4. How could an attacker use a buffer overflow in a worse way than crashing a program?
A. Make the screen brighter
B. Overwrite memory so the program runs the attacker's own code ✓
By carefully choosing the overflow data, an attacker can sneak in their own code and make the program run it.
5. Which check helps prevent a buffer overflow?
A. Check the input length is no bigger than the buffer ✓
B. Accept any amount of input to be helpful
Input validation stops oversized data from ever being written into the buffer.

Match the Pairs

char name[8]; strcpy(name, "Alexandra123"); → Copies 12 or more characters into a buffer that holds only 8, so the extra data overflows into nearby memory
strncpy(name, input, 7); → Copies at most 7 characters, so the input cannot spill past the end of the buffer
An overflow can crash a program, because overwritten memory may hold data the program needs to keep running → Segmentation fault (core dumped)
An attacker can craft input that overflows a buffer and overwrites memory with their own instructions → input = "A" * 200 + attacker_code
char buf[4]; gets(buf); // no length check → gets() reads any amount of input with no size limit, so long input overflows the 4-character buffer. Use fgets(buf, 4, stdin) instead.
Fix: make the buffer bigger and skip checking input length → A bigger buffer only delays the problem, because longer input can still overflow it. The program must always check input length before copying.

Key Term

buffer overflow
When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.

Fill in the Blanks

1. char name[8];
Hint: Type the C data type that stores single characters, used here to create a text buffer.
2. strcpy(name, input);
Hint: Type the C function that copies text into a buffer without checking its length.
3. strncpy(name, input, sizeof(name) - 1);
Hint: Type the operator that gives the size of the buffer in bytes, so the copy stays within it.
4. if (strlen(input) > 7) return;
Hint: Type the comparison operator that spots input longer than the buffer can hold.
5. buffer ← ARRAY OF 8 BYTES FOR i ← 0 TO 7 buffer[i] ← data[i]
Hint: Type the last valid index of the buffer so the loop never writes past its end.

Spot the Error

Question 1
A char name[8];
B char input[20];
C strncpy(name, input, 20);
Line C — name only holds 8 bytes, but this copies up to 20 bytes into it. The extra bytes overflow into nearby memory. The copy length should match the buffer size: strncpy(name, input, 8);
Question 2
A buffer = array of 3 slots
B word = 'HELLO!'
C for each letter in word:
D store letter in buffer
Line A — The word has 6 letters but the buffer only has 3 slots, so the extra letters would overwrite nearby memory. The buffer needs to be big enough: array of 6 slots.
Question 3
A int size = 10;
B char buf[5];
C memcpy(buf, data, size);
Line B — memcpy copies size (10) bytes, but the buffer now only holds 5. The extra 5 bytes overflow into adjacent memory. The buffer should be char buf[10]; to match size.
Question 4
A char buf[5];
B int i;
C for (i = 0; i <= 5; i++)
D buf[i] = 'A';
Line C — A buffer of 5 has positions 0 to 4. Using i <= 5 writes to buf[5], one byte past the end, which overwrites nearby memory. The loop should use i < 5.
Question 5
A if (len < sizeof(buf)) return;
B memcpy(buf, data, len);
C process(buf);
Line A — The check is backwards. It rejects safe short input and lets oversized input through to memcpy, causing an overflow. It should be if (len > sizeof(buf)) return;

Student with a class code? Join your class →