P-3.3 Arrays, Strings and Buffer Overruns
You can work with C arrays and strings, explain why they carry no length, and describe how a buffer overrun happens and what it can be made to do.
In C an array is an address and a promise, and a string is an array that ends with a zero byte. Nothing records how long either one is, so every loop and every copy is trusting a count that lives somewhere else. This is the direct ancestor of a large fraction of the security defects of the last forty years, which is worth understanding once at the level of the memory rather than as a warning to be careful.
Work through these
An array is contiguous storage, and its name is an address
Elements sit one after another in memory and the array itself decays to a pointer to the first one. Indexing is arithmetic on that address, which is why an index past the end is not an error.
A string is bytes ending in a zero, and nothing knows its length
Length is found by walking forward until the terminating byte appears, so a string missing that byte has no end. Every string function in the standard library depends on it being there.
NPTEL: Introduction to Programming in C · CourseWriting past the end of storage, and what happens next
There is no boundary check, so a write past the last element lands on whatever was next in memory. That might be another variable, a saved return address, or nothing important, and it varies between runs.
Why this is a security problem and not only a correctness problem
If an attacker controls the data being copied, they influence what gets written over, and stored return addresses are a well-known target. This is the mechanism behind a whole family of exploits.
Bounded copies, explicit lengths, and checking before you write
The defence is unglamorous: carry the length yourself, use the functions that take a maximum, and check the destination is big enough before copying anything into it.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 31 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.