Buffer Overflow (vs) Buffer OverRun (vs) Stack Overflow

Question

Possible Duplicate:
What is the difference between a stack overflow and buffer overflow ?

What is the difference between Buffer Overflow and Buffer Overrun?

What is the difference between Buffer Overrun and Stack Overflow?

Please include code examples. I have looked at the terms in Wikipedia, but I am unable to match with programming in C or C++ or Java.

Wikipedia clearly states that buffer overrun and buffer overflow are synonyms. Thus your question is a dupe of your own question at http://stackoverflow.com/questions/1120575 — innaM, Jul 17 '09 at 15:44
This questing might be fixable as just what is the difference between Buffer Overflow and Buffer Overrun (A: they are synonyms for the same concept). No reason to let Wikipedia be the source instead of SO. — Yishai, Jul 17 '09 at 15:47
A buffer overrun is one of the most common sources of security risk. A buffer overrun is essentially caused by treating unchecked, external input as trustworthy data — joe, Jul 17 '09 at 15:50
http://msdn.microsoft.com/en-us/library/ms717795(VS.85).aspx — joe, Jul 17 '09 at 15:51
The other question doesn't address the distinction between buffer overrun and overflow, therefore this isn't a duplicate. I voted for reopen @SteveKuo — Sedat Kapanoglu, Dec 31 '20 at 04:42

Joel Coehoorn · Accepted Answer · 2021-01-27T17:05:58.820

42

Think of a buffer as just an array. People often use "overflow" and "overrun" interchangeably for any time you try to reference an index beyond the end of the array, and that's fine. Personally, I make a distinction:

A buffer overflow is when you try to put more items in the array than the array can hold. They flow out of the end of the buffer. In other words, it comes from writing.

A buffer overrun is when you are iterating over the buffer and keep reading past the end of the array. Your iterator is running through the buffer and keeps going. In other words, it comes from reading.

A stack overflow is much different. Most modern programming environments are stack-based, where they use a stack data structure to control program flow. Every time you call a function, a new item is placed on the program's call stack. When the function returns, the item is popped from the stack. When the stack is empty, the program stops. The thing is, this stack has a limited size. It is possible to call too many functions at one time and fill up the stack. At this point you have a stack overflow. The most common way to do this is when a function calls itself (recursion).

edited Jan 27 '21 at 17:05

answered Jul 17 '09 at 15:52

Joel Coehoorn

399,467
113
570
794

2

"A buffer overrun [...] comes from reading" - source? – Paul Aug 12 '20 at 15:04
Would like to check that source for the same quote as @Paul – underthevoid Jan 27 '21 at 16:07
@underthevoid This is very old, but go back and read my second and third sentences very carefully. – Joel Coehoorn Jan 27 '21 at 16:34
You mean by it's being a subjective personal distinction of yours? – underthevoid Jan 27 '21 at 16:49
@underthevoid Yes, but one people seem to agree with. – Joel Coehoorn Jan 27 '21 at 17:04
Drawing my attention back here today, I did opt to also make a few small edits, one of which emphasizes the "personal" nature a bit. – Joel Coehoorn Jan 27 '21 at 17:07

Christopher · Answer 2 · 2009-07-17T18:10:44.750

18

Bufferoverflow / Bufferoverrun:

void k()
{
    BYTE buf[5];
    for( int i = 0; i < 10; ++i )
        buf[i] = 0xcd;
}

Stackoverflow :

void f()
{
     int k = 0;
     f();
}

edited Jul 17 '09 at 18:10

answered Jul 17 '09 at 15:51

Christopher

8,912
3
33
38

i found code for buffer run .. What it is really doing ? – joe Jul 17 '09 at 15:59

score 1 · Answer 3 · answered Jul 17 '09 at 18:51

You can have difference between buffer overflow and buffer overrun in C/C++:

We could define overflow when you index/point beyond the original buffer size (e.g read the 6th element of a 3 element array)
We could define overrun, when you have multiple adjacent buffers after each other, and you index into the second (e.g read the 6th element of the first 3-element array but you get the 3rd element of the second 3-element array).

Stack overflow is kinda buffer overflow when you fill your entire stack 'memory buffer'.

score 0 · Answer 4 · answered Jul 17 '09 at 18:41

What is the difference between Buffer Overflow and Buffer Overrun? I would say that Buffer over flow is when you attempt to write beyond the end of a buffer, but you have a check which prevents it. buffer over run is when you actually write beyond the end of the buffer. The first is fail fast, the second is harder to detect.

You cannot overrun a buffer in java as it always has bounds checking and thus produces a BufferOverflowException.

What is the difference between Buffer Overrun and Stack Overflow?

They have nothing to do with one another.

Buffer Overflow (vs) Buffer OverRun (vs) Stack Overflow

4 Answers4

Linked