Skill 039

Buffer Overflow Detection

Detection Workflow

1. Identify dangerous function calls: strcpy, strcat, sprintf, gets, memcpy without size checks
2. Trace data flow: Use xrefs_to from input sources (network, files, user input) to sinks
3. Verify bounds checking: For each copy operation, check if source size is validated and destination buffer is sufficient
4. Assess exploitability: Can attacker control overflow size? Is there controlled write to critical memory?

Key Patterns

• Stack overflow: Unbounded copy to local buffer
• Heap overflow: Malloc followed by unchecked write
• Off-by-one: Loop condition or bounds check error
• Integer overflow leading to buffer overflow

Output Format

Report with: id, type (stack/heap/static), severity, confidence, location, sink, source, buffer size, overflow potential, evidence, exploitability, mitigation.

Severity Guidelines

• CRITICAL: Unbounded copy to stack buffer, attacker-controlled size
• HIGH: Bounded copy with insufficient checks, off-by-one errors
• MEDIUM: Potential overflow with limited attacker control
• LOW: Unlikely to be exploitable, theoretical only

See Also

• patterns.md - Detailed detection patterns and exploitation scenarios
• examples.md - Example analysis cases and code samples
• references.md - CWE references and mitigation strategies