Question

This an extract from a c program that should demonstrate a bufferoverflow.

void foo()
{
  char arr[8];
  printf(" enter bla bla bla");
  gets(arr);
  printf(" you entered %s\n", arr);
}

The question was “How many input chars can a user maximal enter without a creating a buffer overflow”

My initial answer was 8, because the char-array is 8 bytes long.
Although I was pretty certain my answer was correct, I tried a higher amount of chars, and found that the limit of chars that I can enter, before I get a segmentation fault is 11. (Im running this on A VirtualBox Ubuntu)

So my question is: Why is it possible to enter 11 chars into that 8 byte array?

Answer 1

Your characters are actually exceeding the bounds of the defined array, leading to undefined results. You don’t see the effect until you overwrite some memory that is being used for something else.

The language and runtime aren’t doing anything to prevent you from overflowing the buffer, which is precisely why these bugs are so bad and sometimes hard to track down.

For these reasons, functions like gets are getting deprecated for safer functions (getline in this case) that ask for the length of the array where they will store data.

See: http://crasseux.com/books/ctutorial/gets.html

Also, you can only reliably store 7 characters because you need the 8th for a null terminator.