Which of the following can aid a buffer overflow attack to execute when used in the creation of applications?

Secure cookie storage is a mechanism for protecting session tokens and does not relate to memory buffer management or overflow vulnerabilities.

Many functions in standard C/C++ libraries - such as strcpy(), gets(), and sprintf() - do not perform boundary checks on destination buffers. When developers use these functions without additional validation, they allow input data to exceed allocated memory regions, which is the core mechanism of a buffer overflow attack. Modern secure replacements like strncpy() or fgets() exist precisely to mitigate this risk.

State management governs application workflow and session data consistency but has no direct bearing on memory allocation boundaries that buffer overflows exploit.

Input validation is a defensive control that prevents buffer overflows by rejecting or sanitizing oversized input before it reaches vulnerable functions.