A buffer overflow, or overrun, is an anomaly in which a program writing data to a buffer overruns the buffer's boundaries and overwrites adjacent memory. Typically, this problem occurs when a program is copying strings of characters to a buffer.

C and C++ provide no built-in protection against accessing or overwriting data in any part of memory, and do not automatically check that data written to an array (the built-in buffer type for this language) is within the array's boundaries.

The ABV.UNKNOWN_SIZE checker looks for array bounds violations when the array is of an unknown size.

Vulnerability and risk

Buffer overflows can be triggered by inputs that are designed to execute code or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security.

Consequences of buffer overflow include valid data being overwritten and execution of arbitrary and potentially malicious code. For example, buffer overflows can manipulate a program in several ways:

By overwriting a local variable that is near the buffer in memory to change the behavior of the program to benefit the attacker
By overwriting the return address in a stack frame so that execution resumes at the return address specified by the attacker (usually a user input-filled buffer)
By overwriting a function pointer or exception handler, which is subsequently executed

Vulnerable code example

 
    1  extern char buf[];
    2
    3  void foo(const char* pbuf)
    4  {
    5    int n = -1;
    6    if (pbuf) {
    7       n = strlen(pbuf);
    8       // more code
    9    }
   10    buf[n] = '\0';
   11  }

Klocwork reports this defect when it's able to conclude that buffer overflows occurs, without knowing the size of the buffer precisely: array 'buf' of unknown size may use index value(s) -1.

Related checkers

External guidance

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis for more information.