char pointer overflow

Question

I am new to C and I was wondering if it was possible for a pointer to be overflowed by a vulnerable c function like strcpy(). I have seen it a lot in source code, is it a way to avoid buffer overflows?

Answer 1

http://stackoverflow.com/questions/2807407/how-do-i-prevent-a-char-pointer-buffer-overflow

Answer 2

Yes it is. This is in fact the classic cause of buffer overflow vulnerabilities. The only way to avoid overflowing the buffer is to ensure that you don't do anything that can cause the overflow. In the case of strcpy the solution is to use strncpy which includes the size of the buffer into which the string is being copied.

Answer 3

Sure, if you don't allocate enough space for a buffer, then you certainly can:

char* ptr = (char*)malloc(3);
strcpy(ptr, "this is very, very bad"); /* ptr only has 3 bytes allocated! */

However, what's really bad is that this code could work without giving you any errors, but it may overwrite some memory somewhere that could cause your program to blow up later, seemingly randomly, and you could have no idea why. Those are the source of hours (sometimes even days) of frustration, which anyone whose spent any significant amount of time writing C will tell you.

That is why with C, you have to be extremely careful with such things, and double, triple, nth degree check your code. After that, check it again.

Answer 4

Some other approaches are

#define MAX_LENGTH_NAME 256

foo()
{
char a[MAX_LENGTH_NAME+1]; // You can also use malloc here

strncpy(a,"Foxy",MAX_LENGTH_NAME);

snprintf(a,MAX_LENGTH_NAME,"%s","Foxy");

}

So its good to know the size of allocated memory and then use the calls to avoid buffer overflows. Static analysis of already written code may point out these kinds of mistakes and you can change it too.