-1

What is the difference between buffer overflows and out-of-bounds writes? Are buffer overflows a kind of out-of-bounds writes?

  • Sharing your research helps everyone. Tell us what you've tried and why it didn't meet your needs. This demonstrates that you've taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Jul 1 at 6:04
  • Fundamentally, there isn't any difference. The answer below implies that buffer overflows are associated with hacking, which is true to a degree, but a buffer overflow is just that: an overflow of a buffer. The only way to accomplish a buffer overflow is to do an out-of-bounds write. – Robert Harvey Jul 1 at 17:23
4

What is the difference between buffer overflows and out-of-bounds writes?

A buffer overflow usually refers to an exploit targeting a program written in a language like C that doesn't automatically do array bounds checking, where the point is to overwrite the portion of the stack frame that holds a return address, because by putting something special there the exploit can take control of the program to make the program do things it shouldn't.

Are buffer overflows a kind of out-of-bounds writes?

Yes, I think that is fair to say.  A buffer is an array, and filling it past capacity is an array out of bounds access (or more than one such access).

A programming language that checks array bounds on array access will prevent buffer overflows.


There are other bad writes, such as with a store via an uninitialized pointer or reference; also bad conversions (casts) such as from integer to pointer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.