Buffer over-read

In computer security and programming, a buffer over-read or out-of-bounds read is an anomaly where a program, while reading data from a buffer, overruns the buffer's boundary and reads (or tries to read) adjacent memory. This is a special case of violation of memory safety.

At other times, buffer over-reads not caused by malicious input can lead to crashes if they trigger invalid page faults. For example, widespread IT outages in 2024 were caused by an out-of-bounds memory error in cybersecurity software developed by CrowdStrike.

Programming languages commonly associated with buffer over-reads include C and C++, which provide no built-in protection against using pointers to access data in any part of virtual memory, and which do not automatically check that reading data from a block of memory is safe; respective examples are attempting to read more elements than contained in an array, or failing to append a trailing terminator to a null-terminated string. Bounds checking can prevent buffer over-reads, while fuzz testing can help detect them.

See also

• Buffer overflow
• Computer security
• Type safety

External links

• PHP DateInterval Heap Buffer Overread Denial of Service
• PHP Bug #66060: Heap buffer over-read in DateInterval