What is a buffer overrun?
Below is an excellent, yet brief, description of buffer overruns, which I found on the Microsoft bloggers feed on http://weblogs.asp.net. I do a demo of a buffer overrun in the Essentials of Application Security session, one of two I’m presenting at numerous locations in the eastern US. One of the things I find quite surprising is the relatively high percentage of C++ programmers in the sessions, and even more so, the relatively low percentage of them who’ve actually seen what a buffer overflow looks like. The fact that it’s so easy to code a buffer overflow makes me very glad that I use managed code. Now all I need to do is make sure that I’m not vulnerable to SQL Injection attacks (use stored procedures and good input validation) or Cross-site Scripting attacks (use good validation, and HTML encode all input before echoing it back to the browser).
Buffer overrun attack is a very common attack utilized by hackers. This type of attack is not new. This attack utilizes poor coding practices in C and C++ code, with the handling of string functions. The following code is an example of a buffer overrun.
void myMethod(char * pStr) {char pBuff[10];
int nCount = 0;
strcpy(pBuff, pStr);
}
void foo()
{
}
Cause:
The input pStr is of an unknown size. The string copy is unsafe. If the string (pStr) is greater then 10 characters, then the buffer (pBuff) starts to bleed into nCount and the method foo. The buffer overrun property exploited would allow for the execution of foo by manipulation of the application input.
Solution:
There are three main actions to resolve the problem. First is to utilize the /GS compile option. This option creates a cookie between the stack overrun and the return address. This allows the system to helps prevent buffer overruns, by changing the stack layout. The second action is to use the <strsafe.h> library. This library has buffer overrun safe functions that will help with the detection of buffer overflows. Finally, the last action is to perform extensive code reviews of string functionality and indexes utilized within your application.
NOTE:
This is a description of buffer overruns from a programmer's perspective...I don't have the ability to troubleshoot “buffer overrun” error messages in your programs, so if you ask, that's the answer you'll get. Error messages in programs are best addressed to the product support folks for the program in question.