What is Buffer Copy without Checking Size (CWE-120)?

TL;DR: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) (CWE-120) is a vulnerability that occurs when an application copies an input buffer to an output buffer without verifying the size of the input buffer. To fix it, use a language or library that provides safer string-handling functions.

At-a-Glance

What is Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)?

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) (CWE-120) is a type of buffer overflow vulnerability that occurs when an application copies an input buffer to an output buffer without verifying the size of the input buffer. As defined by the MITRE Corporation under CWE-120, and classified by the OWASP Foundation as None., this vulnerability can lead to confidentiality breaches, integrity modifications, and availability disruptions.

Quick Summary

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) (CWE-120) is a type of buffer overflow vulnerability that occurs when an application copies an input buffer to an output buffer without verifying the size of the input buffer. This vulnerability can lead to confidentiality breaches, integrity modifications, and availability disruptions.

Jump to: What is Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)? · Quick Summary · Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Overview · How Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Works · Business Impact of Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Attack Scenario · How to Detect Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · How to Fix Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · Framework-Specific Fixes for Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · How to Ask AI to Check Your Code for Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Best Practices Checklist · Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) FAQ · Vulnerabilities Related to Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) · References · Scan Your Own Site

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Overview

What: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) (CWE-120) is a type of buffer overflow vulnerability that occurs when an application copies an input buffer to an output buffer without verifying the size of the input buffer.

Why it matters: This vulnerability can lead to confidentiality breaches, integrity modifications, and availability disruptions. An attacker can exploit this vulnerability to execute arbitrary code or cause the application to crash.

Where it occurs: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) (CWE-120) can occur in any application that copies input buffers to output buffers without verifying their size.

Who is affected: Any user who interacts with an application that has this vulnerability is at risk of being affected by a buffer overflow attack.

Who is NOT affected: Users who do not interact with applications that have this vulnerability are not at risk of being affected by a buffer overflow attack. Applications that use languages or libraries that provide safer string-handling functions, such as Java or Perl, are also not at risk.

How Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Works

Root Cause

The root cause of CWE-120 is that the application copies an input buffer to an output buffer without verifying the size of the input buffer.

Attack Flow

1. An attacker sends a malicious input to the application.
2. The application copies the input buffer to an output buffer without verifying its size.
3. The attacker exploits this vulnerability to execute arbitrary code or cause the application to crash.

Prerequisites to Exploit

• The attacker must send a malicious input to the application.
• The application must copy the input buffer to an output buffer without verifying its size.

Vulnerable Code

void handle_request(char *client_data) {
    char output_buffer[64];
    strcpy(output_buffer, client_data);  // client_data length is not checked
}

This code is vulnerable because strcpy() copies client_data — attacker-controlled network input — into a fixed 64-byte stack buffer with no length check. Any input longer than 63 bytes overwrites adjacent stack memory, including (on many platforms) the saved return address.

Secure Code

void handle_request(char *client_data) {
    char output_buffer[64];
    size_t len = strlen(client_data);
    if (len >= sizeof(output_buffer)) {
        return; // reject rather than truncate silently
    }
    memcpy(output_buffer, client_data, len + 1);
}

This code is secure because it measures client_data first and rejects any input that would not fit in output_buffer, so the copy can never write past the end of the destination.

Business Impact of Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

The business impacts of CWE-120 include:

• Confidentiality breaches: sensitive data may be exposed due to a buffer overflow attack.
• Integrity modifications: an attacker can modify memory or execute unauthorized code, leading to integrity modifications.
• Availability disruptions: the application may crash or become unresponsive, leading to availability disruptions.

Some real-world business consequences of CWE-120 include:

• Financial losses due to data breaches
• Compliance issues due to regulatory requirements
• Reputation damage due to public disclosure of vulnerabilities

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Attack Scenario

1. An attacker sends a malicious input to the application.
2. The application copies the input buffer to an output buffer without verifying its size.
3. The attacker exploits this vulnerability to execute arbitrary code or cause the application to crash.

How to Detect Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

Manual Testing

• Check for suspicious code patterns and input validation issues
• Use tools like grep and sed to search for potential vulnerabilities

Automated Scanners (SAST/DAST)

• Use static analysis tools to identify potential buffer overflow vulnerabilities
• Use dynamic testing tools to identify potential buffer overflow vulnerabilities

PenScan Detection

PenScan’s scanner engines actively test for this issue, so you can identify and fix vulnerabilities before an attacker does.

False Positive Guidance

To avoid false positives:

• Be aware of the context in which a vulnerability is detected
• Verify that the vulnerability is not due to a benign condition

How to Fix Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

• Use a language or library that provides safer string-handling functions, such as Java or Perl.
• Implement input validation and environment hardening to prevent buffer overflow attacks.

Some specific fixes for CWE-120 include:

• Using the Safe C String Library (SafeStr) or Strsafe.h library from Microsoft
• Enforcing strict length checks on every copy into a fixed-size buffer
• Implementing environment hardening using techniques like address space layout randomization

Framework-Specific Fixes for Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

CWE-120 is a C/C++ memory-safety weakness — managed-runtime languages (Java, Node.js, Python, PHP) don’t have raw fixed-size buffers exposed to unchecked pointer writes the same way, so a forced example in those languages wouldn’t demonstrate this weakness. The fix belongs at the C/C++ level:

C/C++

Prefer a length-bounded copy function and always pass the real destination size, never a guess:

#include <string.h>

void handle_request(char *client_data) {
    char output_buffer[64];
    snprintf(output_buffer, sizeof(output_buffer), "%s", client_data);
}

snprintf() with sizeof(output_buffer) as the size argument truncates instead of overflowing even if client_data is longer than the buffer — pairing this with the explicit length check above is the standard defense-in-depth pattern for this weakness.

How to Ask AI to Check Your Code for Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

You can use a copy-paste prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) Best Practices Checklist

✅ Use a language or library that provides safer string-handling functions, such as Java or Perl.

✅ Implement input validation and environment hardening to prevent buffer overflow attacks.

✅ Regularly review and update your code to ensure it is free from buffer overflow vulnerabilities.

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) FAQ

How do I prevent CWE-120 buffer overflow attacks?

Use a language that performs its own memory management, such as Java or Perl, which are not subject to buffer overflows. Alternatively, use libraries like Safe C String Library (SafeStr) or Strsafe.h library from Microsoft, which provide safer versions of string-handling functions.

What is the root cause of CWE-120 buffer overflow attacks?

The root cause is that the product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

How do I detect CWE-120 buffer overflow attacks in my application?

You can use manual testing, automated scanners (SAST/DAST), or PenScan detection. Manual testing involves checking for suspicious code patterns and input validation issues. Automated scanners can identify potential vulnerabilities through static analysis and dynamic testing.

How do I fix CWE-120 buffer overflow attacks in my application?

You can use various mitigation strategies, including language selection, libraries or frameworks, environment hardening, input validation, and enforcement by conversion.

What are the business impacts of CWE-120 buffer overflow attacks?

The business impacts include confidentiality breaches, integrity modifications, and availability disruptions. Confidentiality breaches occur when sensitive data is exposed due to a buffer overflow attack. Integrity modifications occur when an attacker can modify memory or execute unauthorized code. Availability disruptions occur when a buffer overflow attack causes the application to crash or become unresponsive.

Can you provide an example of a CWE-120 buffer overflow attack?

Yes, consider a scenario where an attacker sends a malicious input to a web application that copies the input without checking its size. The attacker can exploit this vulnerability to execute arbitrary code or cause the application to crash.

How do I ask AI to check my code for CWE-120 buffer overflow vulnerabilities?

You can use a copy-paste prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

What are some best practices to prevent CWE-120 buffer overflow attacks?

Some best practices include using a language that performs its own memory management, using libraries or frameworks that provide safer string-handling functions, and enforcing input validation and environment hardening.

Vulnerabilities Related to Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

References

• https://cwe.mitre.org/data/definitions/120.html
• https://capec.mitre.org/data/definitions/10.html

• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) and other risks before an attacker does.