← Years 9–10 Digital Systems

Buffer overflow

When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 42

Understanding Buffer overflow in Years 9–10 Digital Systems

What it does: The buffer holds 10 items but 20 are written, so the extra 10 spill into neighbouring memory. This is a buffer overflow and may cause a crash. Overwriting nearby memory can corrupt data the program needs, so a crash is a common result. Bounds checking means testing that the data length is within the buffer's size before writing. Checking after the write is too late.

Common mistakes: The call copies up to 20 bytes into name, which only holds 8, so it overflows the buffer. The copy length must fit the buffer, for example 7 plus the end marker. nums has indexes 0 to 4. Using <= 5 writes to nums[5], one past the end of the array. The loop condition should be i < 5.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Buffer overflow to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A program has a memory area that holds 8 characters. A user enters 20 characters and the program saves them all without checking. What is this?
A firewall ruleA buffer overflow
Matches
char buf[4]; copy(buf, "HELLO WORLD");
↓
The text is 11 characters but the buffer only holds 4, so the extra data overflows and overwrites nearby memory.
Applying
Meanings
Term
buffer overflow
Meaning
When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.
Practice
buffer ← array of size 8
Testing
Gaps
strcpy(, input);
Check Answer
Spots
2char input[20];
3strncpy(name, input, 20);

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Reindeer' badge — Dictionary Guide, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A program has a memory area that holds 8 characters. A user enters 20 characters and the program saves them all without checking. What is this?
A. A buffer overflow ✓
B. A firewall rule
The program wrote more data than the buffer could hold, so the extra data spilled into nearby memory. That is a buffer overflow.
2. What happens to the extra data in a buffer overflow?
A. It is safely deleted by the computer
B. It overwrites nearby memory ✓
The extra data does not vanish. It spills over and overwrites memory next to the buffer, which can damage other data or instructions.
3. Which is a possible result of a buffer overflow?
A. The program gets faster
B. The program crashes ✓
Overwriting nearby memory can corrupt data the program needs, so a crash is a common result.
4. How could an attacker use a buffer overflow to cause serious harm?
A. Overwrite memory so their own code runs ✓
B. Make the screen brightness change
If the overflow overwrites the right part of memory, an attacker may get their own code to run. This is why buffer overflows are a serious vulnerability.
5. Which check helps prevent a buffer overflow?
A. Bounds checking: confirm the data fits before saving it ✓
B. Saving the data first and checking its size later
Bounds checking means testing that the data length is within the buffer's size before writing. Checking after the write is too late.

Match the Pairs

char name[8]; strcpy(name, input); → Copies input into an 8-byte buffer with no size check, so long input overflows into nearby memory
if (len <= 8) { copy(input); } → Bounds checking: only copies the data if it fits inside the buffer
Writing 20 characters into a space that holds only 10 overwrites nearby memory and can crash the program → buffer[10] = input_of_20_chars
Rejecting input that is longer than the buffer stops attackers overflowing it → if (len(input) > 10) { reject }
char buf[4]; copy(buf, "HELLO WORLD"); → The text is 11 characters but the buffer only holds 4, so the extra data overflows and overwrites nearby memory.
copy(buf, input); if (len <= 8) → The bounds check comes after the copy, so the overflow has already happened before the length is checked.

Key Term

buffer overflow
When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.

Fill in the Blanks

1. char buffer[8]; strcpy(buffer, input);
Hint: Type the name of the memory area that receives the copied text
2. if (strlen(input) < sizeof(buffer)) { strcpy(buffer, input); }
Hint: Type the operator that gives the size of the buffer so input can be checked against it
3. strncpy(buffer, input, sizeof(buffer) - 1);
Hint: Type the safer copy function that limits how many characters are copied
4. for (int i = 0; i < 8; i++) { buffer[i] = input[i]; }
Hint: Type the comparison operator that stops the loop before it goes past the last valid index
5. char buffer[8]; strcpy(buffer, "AAAAAAAAAAAAAAAA"); // 16 bytes into 8 bytes = overflow
Hint: Type the word for what happens when more data is written than the buffer can hold

Spot the Error

Question 1
A char name[8];
B char input[20];
C strncpy(name, input, 20);
D name[7] = 0;
Line C — The call copies up to 20 bytes into name, which only holds 8, so it overflows the buffer. The copy length must fit the buffer, for example 7 plus the end marker.
Question 2
A int i, nums[5];
B for (i = 0; i <= 5; i++)
C nums[i] = 0;
Line B — nums has indexes 0 to 4. Using <= 5 writes to nums[5], one past the end of the array. The loop condition should be i < 5.
Question 3
A char buf[10];
B int n = strlen(text);
C if (n > 9)
D n = 19;
E memcpy(buf, text, n);
Line D — The bounds check should cap the length at 9 so it fits in buf. Capping it at 19 still lets up to 19 bytes be copied into a 10 byte buffer.
Question 4
A void greet(char *s) {
B char buf[16];
C strncpy(buf, s, 15);
D buf[16] = 0;
E }
Line D — buf has indexes 0 to 15, so buf[16] writes one byte outside the buffer. The end marker should go in buf[15].
Question 5
A int scores[3] = {5, 6, 7};
B scores[3] = 99;
C printf("%d", scores[2]);
Line B — An array of 3 items has indexes 0, 1 and 2. Writing to scores[3] goes past the end and overwrites nearby memory. It should be scores[2].

Student with a class code? Join your class →