Classic Buffer Overflow
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The classic buffer overflow is copying an input buffer into a destination buffer without first checking that the input fits. It is the specific pattern behind decades of exploits that used unbounded C functions such as strcpy, strcat, sprintf, and gets. When the destination is on the stack the overflow can overwrite the saved return address; when it is on the heap it can corrupt neighbouring objects. It is a narrower case of out-of-bounds write.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A network daemon copies a client-supplied username into a 64-byte stack buffer with strcpy, and a longer name overwrites the return address.
- A legacy CGI program uses gets() to read form data, which has no length limit at all.
- An embedded device's firmware copies an HTTP header into a fixed-size buffer with sprintf.
How to mitigate it
- Ban unbounded functions such as strcpy, strcat, sprintf, and gets; use length-checked alternatives and verify the result.
- Check the input length against the destination size before every copy, accounting for the terminating null byte.
- Enable compiler and OS protections: stack canaries, FORTIFY_SOURCE, ASLR, and non-executable memory.
- Use static analysis rules that flag unsafe copy functions during code review and CI.
Go deeper
Practice this topic
Test your knowledge of Classic Buffer Overflow with exam-style practice questions.