Valgrind won't detect buffer overflow

Question

#include <stdio.h>
main()
{     
    char buf[8];
    sprintf(buf,"AAAA%3s","XXssssssssXXXsssssXXX");
    printf("%s\n",buf);
}

I expected valgrind to detect a buffer overflow with the above code. But it does not report any errors or warnings. Do I need to enable any special flags for that?

Hector

With a recent gcc or clang compiler, you could compile with -Wall -g -fsanitize=address and it might give a message at runtime. BTW sprintf is intrinsically unsafe and should not be used. Use snprintf or asprintf – Spectroscopy

See our CheckPointer tool; it will find many memory errors that valgrind cannot. semdesigns.com/Products/MemorySafety – Levirate

Answer 1

From Valgrind Tutorial

What valgrind is NOT

Although valgrind is an extremely useful program, it will not miraculously tell you about every memory bug in your program. There are several limitations that you should keep in mind. It does not do bounds checking on stack/static arrays ..

Chromatics