John works as a C programmer. He develops the following C program:

#include <stdlib.h> #include <stdio.h> #include <string.h> int buffer(char *str) { char buffer1[10]; strcpy(buffer1, str); return 1; } int main(int argc, char *argv[]) { buffer (argv[1]); printf("Executed\n"); return 1; } His program is vulnerable to a __________ attack.

Question

John works as a C programmer. He develops the following C program:

#include <stdlib.h> #include <stdio.h> #include <string.h> int buffer(char *str) { char buffer1[10]; strcpy(buffer1, str); return 1; } int main(int argc, char *argv[]) { buffer (argv[1]); printf("Executed\n"); return 1; } His program is vulnerable to a __________ attack.

Accepted Answer

C. Buffer overflow The function uses strcpy(buffer1, str) to copy argv[1] into a stack-allocated array of only 10 bytes without any length validation. If the input string exceeds 9 characters, it overwrites adjacent stack memory including the saved return address, enabling a buffer overflow attack. An attacker can exploit this to redirect execution flow or execute arbitrary code.

Answer

A. SQL injection SQL injection involves inserting malicious SQL statements into database queries; this program has no database interaction or query construction.

Answer

B. Denial-of-Service While a very large input could crash the program, the specific vulnerability here is the ability to overwrite stack memory and hijack execution, which is a buffer overflow - not simply a denial-of-service condition.

Answer

D. Cross site scripting Cross-site scripting (XSS) is a web application vulnerability involving injection of malicious scripts into web pages viewed by users; this is a standalone C program with no web or HTML context.

John works as a C programmer. He develops the following C program: #include <stdlib.h> #include <stdio.h> #include <string.h> int buffer(char str) { char buffer1[10]; strcpy(buffer1, str); return 1…

Question

Options

How the community answered

Why each option

Topics

Community Discussion