Buffer Overflow Attack Protection in C# .NET

Introduction:

This tutorial is on how to secure your application in C# from Buffer Overflow Attacks.

What's a Buffer Overflow Attack? (BTA)

A buffer overflow attack is when the user purposefully enters too much data in such a way that the program will spill the data across different memory locations which will cause unexpected behaviour such as opening another vulnerability for the attack to exploit. This works through the use of user input. If the data size is not checked correctly before processing the data in certain ways, it can become vulnerable to a buffer overflow attack from an attacker.

C# Console App:

We are going to use a simple C# console application for this example, so first create a new C# console application project, give it a name, and click 'Create'.

Byte array:

Next we are going to create a byte array which we store the user input in next, notice that we are giving it a fixed size of 255 bytes...

User Input:

Now we are going to get some user input... Convert it to a byte array... And set it to our previously declared 'bytes' byte array with a fixed size of 255 bytes...

Vulnerability

The vulnerability here is that the user could be inputting a string of 256+ bytes/characters and so when converted to bytes, it will be much more than the 'bytes' byte array can handle - a maximum of 255. To fix this, we can simply check the byte count first before setting it to the 'bytes' byte array... Now, if the user enters a string which when converted to bytes is larger than the 'bytes' byte array can handle, it simply won't attempt to set the 'bytes' byte array to the new input (converted to bytes). Finished! Source code...