Heap-based Buffer Overflow
A heap-based buffer overflow occurs when a program writes more data to a memory buffer allocated in the heap than it can hold, corrupting adjacent memory structures. This typically involves buffers created with functions like malloc(), calloc(), or realloc().
This vulnerability happens when your code fails to properly validate the size of data being copied into a dynamically allocated buffer. When you write past the buffer's boundary, you overwrite critical heap management data—like metadata that tracks free and allocated blocks. This corruption can crash the program, lead to unpredictable behavior, or be exploited to execute arbitrary code by an attacker who carefully crafts the overflow data to control program execution. Preventing heap overflows requires rigorous bounds checking, using safe functions (like strncpy instead of strcpy), and tools to detect memory mismanagement. While SAST tools can catch the dangerous pattern, Plexicus uses AI to analyze the context and suggest the precise code fix—such as inserting the correct size check—saving hours of manual review and helping you remediate these flaws across your entire application stack.
Impact: DoS: Crash, Exit, or RestartDoS: Resource Consumption (CPU)DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Impact: Execute Unauthorized Code or CommandsBypass Protection MechanismModify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Impact: Execute Unauthorized Code or CommandsBypass Protection MechanismOther
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Strategy: Environment Hardening
Effectiveness: Defense in Depth
Strategy: Environment Hardening
Effectiveness: Defense in Depth
Strategy: Libraries or Frameworks
Code Example:
cID : DX-19
This example applies an encoding procedure to an input string and stores it into a buffer.Code Example:
c/* encode to < / } else dst_buf[dst_index++] = user_supplied_string[i];} return dst_buf;}
High
- Memory Management
- Memory
- CLASP
- Software Fault Patterns
- CERT C Secure Coding
- ISA/IEC 62443
- ISA/IEC 62443
- ISA/IEC 62443
- ISA/IEC 62443
- ISA/IEC 62443
- ISA/IEC 62443