nerdexam
EC-Council

312-50V9 · Question #102

A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters…

The correct answer is D. if (billingAddress <= 50) {update field} else exit. Preventing buffer overflow on an input field requires validating that the input length does not exceed the allocated field size before processing.

Hacking Web Applications

Question

A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

Options

  • Aif (billingAddress = 50) {update field} else exit
  • Bif (billingAddress != 50) {update field} else exit
  • Cif (billingAddress >= 50) {update field} else exit
  • Dif (billingAddress <= 50) {update field} else exit

How the community answered

(40 responses)
  • A
    10% (4)
  • B
    3% (1)
  • C
    5% (2)
  • D
    83% (33)

Why each option

Preventing buffer overflow on an input field requires validating that the input length does not exceed the allocated field size before processing.

Aif (billingAddress = 50) {update field} else exit

Using a single equals sign is an assignment operation in most languages rather than a comparison, and even as a comparison it only permits input of exactly 50 characters, rejecting all valid shorter inputs.

Bif (billingAddress != 50) {update field} else exit

The not-equal condition (`!= 50`) accepts any length other than exactly 50, meaning it would allow arbitrarily long strings that overflow the buffer.

Cif (billingAddress >= 50) {update field} else exit

The greater-than-or-equal condition (`>= 50`) allows input of 50 characters or more, which permits overflow for any input exceeding the 50-character field limit.

Dif (billingAddress <= 50) {update field} else exitCorrect

Using `if (billingAddress <= 50)` ensures the input is accepted only when its length is within the allocated 50-character buffer, rejecting anything longer. This bounds check prevents writing beyond the buffer boundary, which is the root cause of buffer overflow vulnerabilities.

Concept tested: Input length validation to prevent buffer overflow

Source: https://owasp.org/www-community/vulnerabilities/Buffer_Overflow

Topics

#buffer overflow#input validation#secure coding#boundary checking

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice