In the given C program, which vulnerability arises when argv[1] is copied into a fixed-size buffer?

In the given C program, which vulnerability arises when argv[1] is copied into a fixed-size buffer?

• A. SQL Injection
• B. Format String Bug
• C. Buffer Overflow
• D. Kernel Injection

Answer: (C)

This question tests a buffer overflow vulnerability that happens when untrusted input is copied into a fixed-size buffer without bounds checking. In C, if data from argv[1] is copied into a small local buffer using a function like strcpy, the copy continues until a null terminator is reached, regardless of the buffer’s capacity. If argv[1] is longer than the buffer, the extra bytes overwrite adjacent memory, which can corrupt data or even overwrite the program’s control flow, such as the return address. This can lead to a crash or, in the worst case, arbitrary code execution. This isn’t about SQL statements being built from input (SQL Injection), nor about formatting the input as a string for printf-style functions (Format String Bug). It also isn’t about injecting into the kernel. The described scenario specifically matches a buffer overflow caused by copying oversized input into a fixed-size buffer. Mitigations include bounds-safe operations (like strncpy or snprintf with explicit size), proper input validation, dynamic allocation, and defensive compilation options (stack canaries, ASLR).

This question tests a buffer overflow vulnerability that happens when untrusted input is copied into a fixed-size buffer without bounds checking. In C, if data from argv[1] is copied into a small local buffer using a function like strcpy, the copy continues until a null terminator is reached, regardless of the buffer’s capacity. If argv[1] is longer than the buffer, the extra bytes overwrite adjacent memory, which can corrupt data or even overwrite the program’s control flow, such as the return address. This can lead to a crash or, in the worst case, arbitrary code execution.

This isn’t about SQL statements being built from input (SQL Injection), nor about formatting the input as a string for printf-style functions (Format String Bug). It also isn’t about injecting into the kernel. The described scenario specifically matches a buffer overflow caused by copying oversized input into a fixed-size buffer. Mitigations include bounds-safe operations (like strncpy or snprintf with explicit size), proper input validation, dynamic allocation, and defensive compilation options (stack canaries, ASLR).