LearnViz CompSci
Home / Learn / Security & Cryptography / Buffer Overflow

Intermediate Topic 27 of 51 Security & Cryptography

Buffer Overflow

Writing past a buffer's end to corrupt memory.

How it works

A buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it can hold, overwriting adjacent memory such as variables, saved registers and return addresses. In unsafe languages like C and C++, functions such as strcpy and gets do not check bounds. Attackers can crash programs or redirect execution to injected or existing code. Stack-based and heap-based overflows differ in what they corrupt.

Step-by-step walkthrough

  1. A function reserves a four byte buffer on the stack.
  2. Normal input fills the buffer.
  3. Longer input keeps writing past the end.
  4. It overwrites the saved return address.
  5. When the function returns, execution jumps to attacker-chosen code, so check bounds.

Where it is used

It is a classic memory-safety vulnerability behind many historic worms and remote exploits, and it still appears in firmware, drivers and network services.

Common pitfall

Defenses include bounds-checked functions and safe languages such as Rust, Go and Java, stack canaries, non-executable memory, address space layout randomization and fuzzing during development. Off-by-one errors, integer overflows leading to small allocations and format-string flaws cause related bugs. Use compiler sanitizers, static analysis and code review, and treat all external input lengths as untrusted.

Where it fits in the course

Buffer Overflow is topic 27 of 51 in Security & Cryptography, rated Intermediate. It follows CSRF. The next topic is Denial of Service.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Buffer Overflow?
Writing past a buffer's end to corrupt memory. It belongs to Security & Cryptography and is an intermediate-level topic.
Where do people use Buffer Overflow?
It is a classic memory-safety vulnerability behind many historic worms and remote exploits, and it still appears in firmware, drivers and network services.
What is the most common mistake with Buffer Overflow?
Defenses include bounds-checked functions and safe languages such as Rust, Go and Java, stack canaries, non-executable memory, address space layout randomization and fuzzing during development.
What should I learn before this topic?
Start with CSRF, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Buffer Overflow hard to learn?
It is an Intermediate topic. Be comfortable with the Beginner topics in this area first, then read the common pitfall carefully, since it is where most mistakes happen.
How long does it take to learn Buffer Overflow?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Buffer Overflow?
CSRF, Denial of Service, Cross-Site Scripting are closely connected. The full list is in the related topics section of this page.
What should I study after Buffer Overflow?
Continue with Denial of Service, the next topic in Security & Cryptography.

Related topics