title: Should the memory vulnerability of the line of code "printf("%s", argv[1]);" be described as a stack overflow?
body: <p>Today, I took a short "C++ skills test" from Elance.com.  One question was the following:</p>
  
  <blockquote>
    <p>What is the security vulnerability of the following line of code:</p>
    
    <p><code>printf("%s", argv[1]);</code></p>
    
    <p><strong>Option 1: Format String</strong></p>
    
    <p><strong>Option 2: Stack Overflow</strong> &lt;-- This was marked by Elance as the correct answer</p>
  </blockquote>
  
  <p>The user was provided 10 seconds to answer this question after an initial few seconds of seeing the question (or automatically fail the question).  (There were also two other clearly irrelevant answers that were not marked as the correct answer by Elance.)</p>
  
  <p>I was looking for <strong>buffer overrun</strong> or <strong>buffer overflow</strong> as an option.</p>
  
  <p>I instinctively did not like the answer <em>stack overflow</em>, because in my 10 seconds I mentally used what I believe is the <a href="https://en.wikipedia.org/wiki/Stack_overflow" rel="nofollow">standard definition of "Stack Overflow"</a>:</p>
  
  <blockquote>
    <p>In software, a stack overflow occurs when the stack pointer exceeds
    the stack bound. The call stack may consist of a limited amount of
    address space, often determined at the start of the program ...</p>
  </blockquote>
  
  <p>According to this definition of "Stack Overflow", <strong>a buffer overrun is entirely possible without a stack overflow</strong>; it is a stack overflow only if the program attempts to <strong>write outside the calling program's total <em>stack allocation</em></strong> (whether due to a buffer overrun, or whether it would otherwise be a legitimate write, such as allocating memory for stack-based variables an excessive number of times).</p>
  
  <p>My 10-second instinct told me that "buffer overrun" is a more accurate description of the problematic line of code, above - because often (in my experience) there are sufficient null characters (<code>'\0'</code>) peppered through garbage data in RAM to often avoid an actual stack overflow in cases like this, but a buffer overrun in the implementation seems reasonably possible or even likely.  (But the possibility that <code>printf</code> reads garbage here <em>might</em> assume that <code>argc == 1</code>, such that there <em>was</em> no user-provided <code>argv[1]</code>; if <code>argv[1]</code> is present, perhaps one can assume it's likely that the calling function has not inserted <code>NULL</code>'s.  It was not stated in the problem whether <code>argv[1]</code> was present.)</p>
  
  <p>Because I imagined that there could be a buffer overrun problem here, even without a stack overflow, I answered <strong><em>Format String</em></strong>, because simply by passing a different format string such as <code>"%.8s"</code>, the problem can be mostly avoided, so it seemed like an overall more generic, and therefore better, answer.</p>
  
  <p>My answer was marked as wrong.  The correct answer was marked as "Stack Overflow".</p>
  
  <p>It now occurs to me that perhaps if one assumes that <code>argv[1]</code> is present, that the <strong>only</strong> possible buffer overrun is a stack overflow, in which case, <em>stack overflow</em> might in fact be the correct answer.  However, even in this case, would it not be considered odd to call this a <em>stack overflow</em>?  Isn't <em>buffer overflow</em> a better way to describe this problem, even assuming <code>argv[1]</code> is present?  And, if <code>argv[1]</code> is <strong>not</strong> present, isn't it pretty much incorrect to state that the problem is <em>stack overflow</em>, rather than the more accurate <em>buffer overrun</em>?</p>
  
  <p>I would like the opinion of professionals on this site: Is "stack overflow" the proper way to define the memory safety problem with the above line of code?  Or, rather, is "buffer overflow" or "buffer overrun" clearly a <em>better</em> way to describe the problem?  Finally, given the two options provided for the question's answer (above), is the answer ambiguous, or is "stack overflow" (or "format string") clearly the better answer?</p>
  
  <hr>
  
  <p><strong>Tangential Comments regarding the Elance test</strong>  (Not related to the question in this posting)</p>
  
  <p>None of the Elance "<strong>C++</strong> skills test" questions pertained to <strong>any</strong> C++-specific features such as classes, templates, anything in the STL, or any aspect of polymorphism.  Every question was a down-and-out, straight-from-C question.</p>
  
  <p>Because there were many (at least 3) other questions in Elance's so-called "C++ skills test" that were unarguably wrong (such as this question: given <code>sizeof(int) == sizeof(int*)</code> and <code>sizeof(int) == 4</code>, then in the code <code>int *a, *b; a=b; b++; b-a;</code>, what is <code>b-a</code>, with the correct answer listed as <code>4</code>, rather than the actual correct answer of <code>1</code>), and given the fact that there were no C++-specific questions on the test, I have contacted Elance and plan to seriously pursue their problematic test with the organization.  However, for the question discussed in this posting, I am uncertain whether the question/answers are problematic.</p>