# Buffer Overflow

> Detects unsafe C/C++ functions that copy data without bounds checking, enabling stack and heap buffer overflows.

- Skill: `zakirkun/buffer-overflow` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/buffer-overflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/buffer-overflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/buffer-overflow

---


# Buffer Overflow

## Overview
Buffer overflows occur when data is written beyond the boundaries of allocated memory. In C/C++, unsafe library functions have no bounds checking:
- `gets()`: Reads unlimited input into fixed buffer — deprecated and removed from C11
- `strcpy()`: Copies until null terminator with no size limit
- `strcat()`: Concatenates with no size limit
- `sprintf()`: Formats with no output buffer size check

Consequences: Stack corruption, return address overwrite, arbitrary code execution, privilege escalation.

## Remediation
Replace unsafe functions with safe alternatives:
- `gets()` → `fgets(buf, sizeof(buf), stdin)` or `getline()`
- `strcpy()` → `strncpy()` + manual null termination, or `strlcpy()`
- `strcat()` → `strncat()` or `strlcat()`
- `sprintf()` → `snprintf(buf, sizeof(buf), ...)`