buffer-overrun

Confused by gdb print ptr vs print "%s"

1167 ptr = (void*)getcwd(cwd, MAX_PATH_LENGTH-1); (gdb) n 1168 if (!ptr) { (gdb) print ptr $1 = 0xbff2d96c "/media/MMC-SD/partition1/aaaaaaaaaaa" (gdb) print &cwd $2 = (char (*)[3500]) 0xbff2d96c (gdb) print strlen(cwd) $3 = 36 (gdb) print "%s",cwd $4 = "/media/MMC-SD/partition1/aaaaaaaaaaa", '\0' <repeats 912 times>, "��O�001\...

How can I overcome inconsistent behaviour of snprintf in different UNIX-like operating systems??

Per man pages, snprintf is returning number of bytes written from glibc version 2.2 onwards. But on lower versions of libc2.2 and HP-UX, it returns a positive integer, which could lead to a buffer overflow. How can one overcome this and write portable code? Edit : For want of more clarity This code is working perfectly in lib 2.3 if...

Is buffer overflow/overrun possible in completely managed asp.net c# web application

Can there be buffer overflow/overrun vulnerabilities in completely managed asp.net web portal.If yes how can this be tested. ...

What C/C++ functions are most often used incorrectly and can lead to buffer overflows?

I've been asked to maintain a large C++ codebase full of memory leaks. While poking around, I found out that we have a lot of buffer overflows that lead to the leaks (how it got this bad, I don't ever want to know). I've decided to removing the buffer overflows first, starting with the dangerous functions. What C/C++ functions that are...

What C/C++ tools can check for buffer overflows?

I've been asked to maintain a large C++ codebase full of memory leaks. While poking around, I found out that we have a lot of buffer overflows that lead to the leaks (how it got this bad, I don't ever want to know). I've decided to removing the buffer overflows first. To make my bug-hunting easier, what tools can be used to check for bu...

Does Java have buffer overflows?

Does Java have buffer overflows? If yes can you give me scenarios? ...

How do you program safely outside of a managed code environment?

If you are someone who programs in C or C++, without the managed-language benefits of memory management, type checking or buffer overrun protection, using pointer arithmetic, how do you make sure that your programs are safe? Do you use a lot of unit tests, or are you just a cautious coder? Do you have other methods? ...

if one complains about gets(), why not do the same with scanf("%s",...)?

From man gets: Never use gets(). Because it is impossible to tell without knowing the data in advance how many characters gets() will read, and because gets() will continue to store characters past the end of the buffer, it is extremely dangerous to use. It has been used to break computer security. Use fg...

Avoiding 'Buffer Overrun' C6386 warning

In my code, I am using an array xyz of 10 objects. When I am trying to access an element of the array using an unsigned int index like this: xyz[level], I get 'Buffer overrun' warning. Logically, I am pretty sure that level won't exceed 10. How to avoid this warning? ...

buffer overrun throw return address

Hi, When I throw in a method A, it causes buffer overrun but when I return, it runs fine. I thought throw moves execution to the caller method so the address it goes to should be the same as return address, but i am obviuosly wrong. Is there a way to see what address throw goes to in Visual Studio debugger? Thank you Berkus: does this ...

Does reading from outside the buffer also count as buffer overrun?

My concern is the definition of buffer overrun. Looks like it only applies to writing outside the buffer. But recently we found a spectacular bug when the program attempted to read from outside the legally allocated block of memory and ran into undefined behavior - either crashed with access violation or sent unrelated data across the ...