312-50V11 · Question #328
A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters…
The correct answer is D. if (billingAddress <= 50) {update field} else exit. To prevent a buffer overflow, input must be validated to ensure it does not exceed the maximum allowed size before processing.
Question
A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?
Options
- Aif (billingAddress = 50) {update field} else exit
- Bif (billingAddress != 50) {update field} else exit
- Cif (billingAddress >= 50) {update field} else exit
- Dif (billingAddress <= 50) {update field} else exit
How the community answered
(62 responses)- A2% (1)
- B5% (3)
- C10% (6)
- D84% (52)
Why each option
To prevent a buffer overflow, input must be validated to ensure it does not exceed the maximum allowed size before processing.
This checks for an exact length of 50 and would reject all valid shorter inputs, and also uses an assignment operator rather than a comparison in many languages.
This allows any length that is not exactly 50, which includes values greater than 50 and would permit a buffer overflow.
This allows updates only when the address is 50 characters or more, which permits oversized input and does not prevent a buffer overflow.
Using `if (billingAddress <= 50)` ensures the field is only updated when the input length is within the defined 50-character limit, rejecting anything larger. This boundary check prevents excess data from overflowing the allocated buffer and is the correct guard condition for this constraint.
Concept tested: Input length validation to prevent buffer overflow
Source: https://owasp.org/www-community/vulnerabilities/Buffer_Overflow