Buffer overflow

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A program has a memory area that holds 8 characters. A user enters 20 characters and the program saves them all without checking. What is this?

A A buffer overflow

B A firewall rule

2. What happens to the extra data in a buffer overflow?

A It is safely deleted by the computer

B It overwrites nearby memory

3. Which is a possible result of a buffer overflow?

A The program gets faster

B The program crashes

4. How could an attacker use a buffer overflow to cause serious harm?

A Overwrite memory so their own code runs

B Make the screen brightness change

5. Which check helps prevent a buffer overflow?

A Bounds checking: confirm the data fits before saving it

B Saving the data first and checking its size later

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1char name[8]; strcpy(name, input);		ABounds checking: only copies the data if it fits inside the buffer
2if (len <= 8) { copy(input); }		BCopies input into an 8-byte buffer with no size check, so long input overflows into nearby memory
3Writing 20 characters into a space that holds only 10 overwrites nearby memory and can crash the program		CThe text is 11 characters but the buffer only holds 4, so the extra data overflows and overwrites nearby memory.
4Rejecting input that is longer than the buffer stops attackers overflowing it		DThe bounds check comes after the copy, so the overflow has already happened before the length is checked.
5char buf[4]; copy(buf, "HELLO WORLD");		Ebuffer[10] = input_of_20_chars
6copy(buf, input); if (len <= 8)		Fif (len(input) > 10) { reject }

Definitions

buffer overflow

Fill in the Blanks

Complete each line of code by filling in the missing parts.

char buffer[8]; strcpy(______, input);

if (strlen(input) < ______(buffer)) { strcpy(buffer, input); }

_______(buffer, input, sizeof(buffer) - 1);

for (int i = 0; i _ 8; i++) { buffer[i] = input[i]; }

char buffer[8]; strcpy(buffer, "AAAAAAAAAAAAAAAA"); // 16 bytes into 8 bytes = ________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A char name[8];

B char input[20];

C strncpy(name, input, 20);

D name[7] = 0;

Question 2

A int i, nums[5];

B for (i = 0; i <= 5; i++)

C nums[i] = 0;

Question 3

A char buf[10];

B int n = strlen(text);

C if (n > 9)

D n = 19;

E memcpy(buf, text, n);

Question 4

A void greet(char *s) {

B char buf[16];

C strncpy(buf, s, 15);

D buf[16] = 0;

E }

Question 5

A int scores[3] = {5, 6, 7};

B scores[3] = 99;

C printf("%d", scores[2]);

Answer Key

Buffer overflow

Section A: Quick Questions

A — A buffer overflow

B — It overwrites nearby memory

B — The program crashes

A — Overwrite memory so their own code runs

A — Bounds checking: confirm the data fits before saving it

Section B: Match the Pairs

char name[8]; strcpy(name, input); → Copies input into an 8-byte buffer with no size check, so long input overflows into nearby memory

if (len <= 8) { copy(input); } → Bounds checking: only copies the data if it fits inside the buffer

Writing 20 characters into a space that holds only 10 overwrites nearby memory and can crash the program → buffer[10] = input_of_20_chars

Rejecting input that is longer than the buffer stops attackers overflowing it → if (len(input) > 10) { reject }

char buf[4]; copy(buf, "HELLO WORLD"); → The text is 11 characters but the buffer only holds 4, so the extra data overflows and overwrites nearby memory.

copy(buf, input); if (len <= 8) → The bounds check comes after the copy, so the overflow has already happened before the length is checked.

Section C: Definitions

buffer overflow — When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.

Section D: Fill in the Blanks

char buffer[8];
strcpy(buffer, input);

if (strlen(input) < sizeof(buffer)) {
    strcpy(buffer, input);
}

strncpy(buffer, input, sizeof(buffer) - 1);

for (int i = 0; i < 8; i++) {
    buffer[i] = input[i];
}

char buffer[8];
strcpy(buffer, "AAAAAAAAAAAAAAAA");
// 16 bytes into 8 bytes = overflow

Section E: Spot the Error

C — The call copies up to 20 bytes into name, which only holds 8, so it overflows the buffer. The copy length must fit the buffer, for example 7 plus the end marker.

B — nums has indexes 0 to 4. Using <= 5 writes to nums[5], one past the end of the array. The loop condition should be i < 5.

D — The bounds check should cap the length at 9 so it fits in buf. Capping it at 19 still lets up to 19 bytes be copied into a 10 byte buffer.

D — buf has indexes 0 to 15, so buf[16] writes one byte outside the buffer. The end marker should go in buf[15].

B — An array of 3 items has indexes 0, 1 and 2. Writing to scores[3] goes past the end and overwrites nearby memory. It should be scores[2].