Page History

...

In this example taken from Dowd, buf_ptr is used to insert new integers into buf, which is an array of 1024 integers. If there is data to be inserted into buf (which is indicated by havedata()) and buf_ptr has not been incremented past buf + sizeof(buf), then an integer is inserted into buf via buf_ptr. However, the sizeof operator returns the total number of bytes in buf, which, assuming four-byte integers, is 4096 bytes. This value is then scaled to the size of an integer and added to buf. As a result, it is possible to write integers the check to make sure integers are not written past the end of buf is incorrect and cause a buffer overflow occurs.

int buf[1024];
int *buf_ptr = buf;

while (havedata() && buf_ptr < buf + sizeof(buf))
{
    *buf_ptr++ = parseint(getdata());
}

...