WCU / Cybersecurity
~/CSC 472/Class 01/KP 11
Class 01 · KP 11 / 18

Why C Has No Bounds Checking

char buf[8];
strcpy(buf, user_input);   // no length check at all
  • C treats memory as a flat array of bytes; a pointer is just an address plus a type. There is no runtime record of how big buf is.
  • If user_input is longer than 8 bytes, strcpy happily writes past the buffer, corrupting whatever sits next: other locals, the saved frame pointer, the return address.
  • This is a deliberate design trade: C chooses speed and control over safety. The programmer is responsible for every bound.
  • Memory-safe languages (Rust, Go, Java) add this bookkeeping; that is exactly the check C omits.
Key Takeaway

The absence of bounds checking is the root cause behind most of this course. Overflows are the direct consequence.