Buffer overflow

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A program has a buffer that holds 8 characters. A user types 20 characters and the program saves them all without checking. What is this?

A A buffer overflow

B A normal save

2. What does a buffer overflow overwrite?

A Nearby memory next to the buffer

B Only the buffer's own memory

3. Which is the simplest result of a buffer overflow?

A The program gets faster

B The program crashes

4. How could an attacker use a buffer overflow in a worse way than crashing a program?

A Make the screen brighter

B Overwrite memory so the program runs the attacker's own code

5. Which check helps prevent a buffer overflow?

A Check the input length is no bigger than the buffer

B Accept any amount of input to be helpful

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1char name[8]; strcpy(name, "Alexandra123");		Ainput = "A" * 200 + attacker_code
2strncpy(name, input, 7);		BA bigger buffer only delays the problem, because longer input can still overflow it. The program must always check input length before copying.
3An overflow can crash a program, because overwritten memory may hold data the program needs to keep running		Cgets() reads any amount of input with no size limit, so long input overflows the 4-character buffer. Use fgets(buf, 4, stdin) instead.
4An attacker can craft input that overflows a buffer and overwrites memory with their own instructions		DCopies at most 7 characters, so the input cannot spill past the end of the buffer
5char buf[4]; gets(buf); // no length check		ECopies 12 or more characters into a buffer that holds only 8, so the extra data overflows into nearby memory
6Fix: make the buffer bigger and skip checking input length		FSegmentation fault (core dumped)

Definitions

buffer overflow

Fill in the Blanks

Complete each line of code by filling in the missing parts.

____ name[8];

______(name, input);

strncpy(name, input, ______(name) - 1);

if (strlen(input) _ 7) return;

buffer ← ARRAY OF 8 BYTES FOR i ← 0 TO _ buffer[i] ← data[i]

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A char name[8];

B char input[20];

C strncpy(name, input, 20);

Question 2

A buffer = array of 3 slots

B word = 'HELLO!'

C for each letter in word:

D store letter in buffer

Question 3

A int size = 10;

B char buf[5];

C memcpy(buf, data, size);

Question 4

A char buf[5];

B int i;

C for (i = 0; i <= 5; i++)

D buf[i] = 'A';

Question 5

A if (len < sizeof(buf)) return;

B memcpy(buf, data, len);

C process(buf);

Answer Key

Buffer overflow

Section A: Quick Questions

A — A buffer overflow

A — Nearby memory next to the buffer

B — The program crashes

B — Overwrite memory so the program runs the attacker's own code

A — Check the input length is no bigger than the buffer

Section B: Match the Pairs

char name[8]; strcpy(name, "Alexandra123"); → Copies 12 or more characters into a buffer that holds only 8, so the extra data overflows into nearby memory

strncpy(name, input, 7); → Copies at most 7 characters, so the input cannot spill past the end of the buffer

An overflow can crash a program, because overwritten memory may hold data the program needs to keep running → Segmentation fault (core dumped)

An attacker can craft input that overflows a buffer and overwrites memory with their own instructions → input = "A" * 200 + attacker_code

char buf[4]; gets(buf); // no length check → gets() reads any amount of input with no size limit, so long input overflows the 4-character buffer. Use fgets(buf, 4, stdin) instead.

Fix: make the buffer bigger and skip checking input length → A bigger buffer only delays the problem, because longer input can still overflow it. The program must always check input length before copying.

Section C: Definitions

buffer overflow — When a program writes more data into a memory area (buffer) than it can hold, overwriting nearby memory. This can crash the program or let an attacker run their own code.

Section D: Fill in the Blanks

char name[8];

strcpy(name, input);

strncpy(name, input, sizeof(name) - 1);

if (strlen(input) > 7) return;

buffer ← ARRAY OF 8 BYTES
FOR i ← 0 TO 7
    buffer[i] ← data[i]

Section E: Spot the Error

C — name only holds 8 bytes, but this copies up to 20 bytes into it. The extra bytes overflow into nearby memory. The copy length should match the buffer size: strncpy(name, input, 8);

A — The word has 6 letters but the buffer only has 3 slots, so the extra letters would overwrite nearby memory. The buffer needs to be big enough: array of 6 slots.

B — memcpy copies size (10) bytes, but the buffer now only holds 5. The extra 5 bytes overflow into adjacent memory. The buffer should be char buf[10]; to match size.

C — A buffer of 5 has positions 0 to 4. Using i <= 5 writes to buf[5], one byte past the end, which overwrites nearby memory. The loop should use i < 5.

A — The check is backwards. It rejects safe short input and lets oversized input through to memcpy, causing an overflow. It should be if (len > sizeof(buf)) return;