Buffer overflow in JAVA

Question

Ok so I'm doing some research on buffer overflows. I've got a C program that is vulnerable to a variable attack that I'm trying to convert to java. Does anyone think they could help me? So far I still haven't been able to get the java code to compile.

C Code

#include <stdio.h>
#include <string.h>

/*
A routine that checks whether the password is correct or not
Standard library call "gets()" does not check for buffer overflow
*/
int checkPassword(){
    char passwordFlag = 'F';
    char inputPwd[10];
    memset(inputPwd, 0, 10);

    gets(inputPwd);
    if (!strcmp(inputPwd, "goodpass")){
        passwordFlag = 'T';
    }
    if (passwordFlag == 'T'){
        return 1;
    }
    else{
        return 0;
    }
}

int main()
{
    printf("Please enter a password\n");
    if (checkPassword() == 1 )
    {
        printf("Successful\n");
        return 0;
    }
    else{
        printf("Access Denied.\n");
        return -1; 
    }
}

Java Code (not currently compiling)

import java.io.*;
class Numbers {
    public static void main(String[] args) {
            BufferedReader br = new BufferedReader(new InputStreamReader(System.in));
            System.out.println("Please enter a password");
                if (checkPassword() == 1 )
                {
                    System.out.println("Successful");
                    System.exit(1); //you wouldn't exit here but its not like i'm doing anything important
                }
                else{
                    System.out.println("Access Denied.");
                    System.exit(1);
                }


    }
    public static Integer checkPassword(){
                char passwordFlag = 'F';
                char inputPwd[10];
                memset(inputPwd, 0, 10);

                gets(inputPwd);
                if (!strcmp(inputPwd, "goodpass")){
                    passwordFlag = 'T';
                }
                if (passwordFlag == 'T'){
                    return 1;
                }
                else{
                    return 0;
                }
            }
}

Answer 1

That kind of buffer overflow does not exist in Java. On the JVM level an IndexOutOfBoundsException would be raised.

Answer 2

Your code has several problems, I'll point out a couple:

 char inputPwd[10];
 memset(inputPwd, 0, 10);

Should be:

 char[] inputPwd = new char[10];
 // no need to set to 0, since arrays are initialised to zero.

Also, gets() doesn't exist in Java, you'll probably want:

 br.readLine(); 

instead (and you'll also have to pass your BufferedReader in to the function, and either catch or throw the exception it might generate). Note that this reads a whole line instead of just a string.

However, I wouldn't worry about converting it, since buffer overflows don't really work like this in Java , see: Does Java have buffer overflows?