In
computer security and
programming, a buffer over-read is an
anomaly
Anomaly may refer to:
Science
Natural
*Anomaly (natural sciences)
** Atmospheric anomaly
** Geophysical anomaly
Medical
* Congenital anomaly (birth defect), a disorder present at birth
** Physical anomaly, a deformation of an anatomical struct ...
where a
program, while reading
data from a
buffer, overruns the buffer's boundary and reads (or tries to read) adjacent memory. This is a special case of violation of
memory safety.
Buffer over-reads can be triggered, as in the
Heartbleed bug, by maliciously crafted inputs that are designed to exploit a lack of
bounds checking to read parts of memory not intended to be accessible. They may also be caused by programming errors alone. Buffer over-reads can result in erratic program behavior, including
memory access errors, incorrect results, a
crash, or a breach of system security. Thus, they are the basis of many
software vulnerabilities and can be maliciously
exploited to access privileged information.
Programming languages commonly associated with buffer over-reads include
C and
C++, which provide no built-in protection against using
pointers to access data in any part of
virtual memory, and which do not automatically check that reading data from a block of memory is safe; respective examples are attempting to read more elements than contained in an array, or failing to append a trailing terminator to a
null-terminated string.
Bounds checking can prevent buffer over-reads,
while
fuzz testing
Fuzz may refer to:
* ''Fuzz'' (film), a 1972 American comedy
* '' Fuzz: When Nature Breaks the Law'', a nonfiction book by Mary Roach
* The fuzz, a slang term for police officers
Music
* Fuzz (electric guitar), distortion effects to create "wa ...
can help detect them.
See also
*
Buffer overflow
*
Computer security
*
Type safety
References
External links
PHP DateInterval Heap Buffer Overread Denial of ServicePHP Bug #66060: Heap buffer over-read in DateInterval
Software bugs
Computer memory
Computer security exploits
{{Computer-security-stub