In their book The Practice of Programming (which is well worth reading), Kernighan and Pike discuss this problem, and they solve it by using snprintf() to create the string with the correct buffer size for passing to the scanf() family of functions. In effect: int scanner(const char *data, char *buffer, size_t buflen) { char format[32]; … Read more
Since Java Strings are based on char arrays and Java automatically checks array bounds, buffer overflows are only possible in unusual scenarios: If you call native code via JNI In the JVM itself (usually written in C++) The interpreter or JIT compiler does not work correctly (Java bytecode mandated bounds checks)
The strncpy() function was designed with a very particular problem in mind: manipulating strings stored in the manner of original UNIX directory entries. These used a short fixed-sized array (14 bytes), and a nul-terminator was only used if the filename was shorter than the array. That’s what’s behind the two oddities of strncpy(): It doesn’t … Read more
On most compilers the maximum value of an unsigned short is 65535. Any value above that gets wrapped around, so 65536 becomes 0, and 65600 becomes 65. This means that long strings of the right length (e.g. 65600) will pass the check, and overflow the buffer. Use size_t to store the result of strlen(), not … Read more
On my laptop running Ubuntu 14.04, this code does not break it runs to completion. On my school’s computer running CentOS 6.6, it also runs fine. On Windows 8.1, the loop never terminates. What is more strange is when I edit the conditional of the for loop to: i <= 11, the code only terminates … Read more
Why is gets() dangerous The first internet worm (the Morris Internet Worm) escaped about 30 years ago (1988-11-02), and it used gets() and a buffer overflow as one of its methods of propagating from system to system. The basic problem is that the function doesn’t know how big the buffer is, so it continues reading … Read more