Buffer Overflow (vs) Buffer OverRun (vs) Stack Overflow

Question

Possible Duplicate:
What is the difference between a stack overflow and buffer overflow ?

What is the difference between Buffer Overflow and Buffer Overrun?

What is the difference between Buffer Overrun and Stack Overflow?

Please include code examples. I have looked at the terms in Wikipedia, but I am unable to match with programming in C or C++ or Java.

Answer 1

Bufferoverflow / Bufferoverrun:

void k()
{
    BYTE buf[5];
    for( int i = 0; i < 10; ++i )
        buf[i] = 0xcd;
}

Stackoverflow :

void f()
{
     int k = 0;
     f();
}

Answer 2

Think of a buffer as just an array. A buffer overflow is when you try to put more items in the array than what the array can hold. In words, it comes from writing. A buffer overrun is when you are iterating over the buffer and keep reading past the end of the array. In other words, it comes from reading.

A stack overflow is much different. Most modern programming environments are stack-based, where they use a stack data structure to control program flow. Every time you call a function, a new item is placed on the program's call stack. When the function return, that item is popped of the stack. When the stack is empty, the program stops. The thing is that this stack has a fixed size, and so it is possible to call too many functions at one time. At this point you have a stack overflow. The most common way to do this is with a function that calls itself (recursion).

Answer 3

What is the difference between Buffer Overflow and Buffer Overrun? I would say that Buffer over flow is when you attempt to write beyond the end of a buffer, but you have a check which prevents it. buffer over run is when you actually write beyond the end of the buffer. The first is fail fast, the second is harder to detect.

You cannot overrun a buffer in java as it always has bounds checking and thus produces a BufferOverflowException.

What is the difference between Buffer Overrun and Stack Overflow?

They have nothing to do with one another.

Answer 4

You can have difference between buffer overflow and buffer overrun in C/C++:

• We could define overflow when you index/point beyond the original buffer size (e.g read the 6th element of a 3 element array)
• We could define overrun, when you have multiple adjacent buffers after each other, and you index into the second (e.g read the 6th element of the first 3-element array but you get the 3rd element of the second 3-element array).

Stack overflow is kinda buffer overflow when you fill your entire stack 'memory buffer'.