Buffer Overflows

Buffer overflows occur when a program writes more data to a memory buffer than it can hold, overwriting adjacent memory.

This class of defect has been exploited to compromise systems since the 1980s. The Morris Worm (1988) used a buffer overflow. It remains one of the most common critical defect classes today.

Buffer overflows are largely preventable through the use of memory-safe programming languages, bounds checking, and compiler protections.

Discussion prompts

• Does your codebase use languages or libraries that make buffer overflows possible? What is your mitigation strategy? How do you measure success?
• What does it say about software liability that buffer overflows still appear in critical systems today?
• What would your architecture look like if buffer overflows were structurally impossible?