Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Will any programs detect a buffer overflow within a C/C++ structure?

Consider the following program:

struct abc
{
    int x[5];
    int y[5];
};

int main()
{
    struct abc test;
    test.y[0] = 10;
    printf("%d", test.x[5]);
}

(borrowed from Is it legal to overrun one element of a struct to view another?)

BoundsChecker does not detect this as an overflow. Are there any programs that will detect this type of programming error?

like image 299
user265445 Avatar asked Feb 23 '23 03:02

user265445


1 Answers

clang does, even with no special flags turned on:

$ clang example.c -o example
example.c:13:18: warning: array index of '5' indexes past the end of an array
      (that contains 5 elements) [-Warray-bounds]
    printf("%d", test.x[5]);
                 ^      ~
example.c:5:5: note: array 'x' declared here
    int x[5];
    ^
1 warning generated.

The same warning is printed when compiling as C++.

like image 119
Carl Norum Avatar answered Feb 24 '23 16:02

Carl Norum