GCIH · Question #103
Which of the following programming languages are NOT vulnerable to buffer overflow attacks? Each correct answer represents a complete solution. Choose two.
The correct answer is B. Java D. Perl. Java and Perl include automatic memory management and runtime bounds checking, making buffer overflow attacks impossible at the language level. C and C++ rely on manual memory management and allow unchecked pointer operations, making them inherently vulnerable.
Question
Which of the following programming languages are NOT vulnerable to buffer overflow attacks? Each correct answer represents a complete solution. Choose two.
Options
- AC
- BJava
- CC++
- DPerl
How the community answered
(46 responses)- A4% (2)
- B93% (43)
- C2% (1)
Why each option
Java and Perl include automatic memory management and runtime bounds checking, making buffer overflow attacks impossible at the language level. C and C++ rely on manual memory management and allow unchecked pointer operations, making them inherently vulnerable.
C provides direct pointer arithmetic and low-level memory functions such as strcpy and gets with no built-in bounds checking, making it one of the most common languages in which buffer overflow vulnerabilities occur.
Java's JVM enforces strict array bounds checking at runtime and uses automatic garbage collection, making it architecturally impossible for a program to write data beyond an allocated buffer boundary as can happen in C or C++.
C++ inherits C's low-level manual memory management and pointer semantics, so without explicit bounds checking code, C++ programs are equally susceptible to buffer overflow attacks as C programs.
Perl is an interpreted language with dynamic, automatic memory management for strings and arrays, which prevents the kind of fixed-size buffer allocation and manual pointer manipulation that leads to buffer overflow vulnerabilities.
Concept tested: Language memory safety and buffer overflow immunity
Source: https://owasp.org/www-community/vulnerabilities/Buffer_Overflow
Topics
Community Discussion
No community discussion yet for this question.