Buffer Overflow Problem

Question

I am trying to run a buffer overflow example to run some code, but the problem is that when I try to run the code just to get a buffer overflow, Windows throws a prompt up stating "Program has stopped working, Windows is checking for a solution to the program. So when I try to make sure it just has a overflow by one byte. The program just runs, but doesn't pause the command window in order for me to see the segmentation fault error address. Which to my understanding I would need in order to change it and make it run my desired window as the passed parameter.Here is the simple program.

#define BUF_LEN 5

int main(int argc, char **argv)
{

char buf[BUF_LEN];

if (argc > 1)
{
 strcpy(buf, argv[1]);
}
 return 0;
 printf(buf);
 system("pause");
}

I make it at least more than buff, for example buff is now 5 in this program, so I make it "AAAAAAAA" — Eric
– Eric, Commented Dec 1, 2010 at 0:21

Karl Knechtel · Accepted Answer · 2010-12-01 00:10:38Z

2

Segmentation faults are just one manifestation of undefined behaviour. There is really nothing that guarantees you that the OS will give you any information about what went wrong here.

You don't need the address in order to diagnose the segfault anyway. There is exactly one thing that can cause a buffer overflow here and you know exactly what it is: the strcpy() call.

Assuming you must use C, the fix is to use strncpy() instead.

answered Dec 1, 2010 at 0:10

Karl Knechtel

61.4k14 gold badges131 silver badges193 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Lars Over a year ago

I may be mistaken, but if I read the OP right, he intentionally wants to cause a buffer overflow for exercise purposes.

Eric Over a year ago

I know that strncpy() will prevent the buffer overflow. but I am trying to create an exmaple to show what I can make happen by causing one with some shellcode, but I assummed I need the seg fault address to do that

Eric Over a year ago

This doesnt answer my question at all but yet it has two votes?

Ira Baxter Over a year ago

@Eric: What part of "undefined behavior" didn't you understand?

Lars · Accepted Answer · 2010-12-01 00:13:53Z

1

The problem lies with the fact that buffer overflow behavior is not standardized - your example may refer to an older version of Windows, which still printed an error address, or to a completely different operating system.

Additionally, not all buffer overflows cause the program to crash - it depends on what data is written where. For small buffer overflows, you may be overwriting only some other local variables or padding space, instead of anything essential for the program execution (like the function return address).

answered Dec 1, 2010 at 0:13

Lars

1,3876 silver badges7 bronze badges

1 Comment

Eric Over a year ago

this actually answered the question

user418748 · Accepted Answer · 2010-12-01 00:04:08Z

0

#define BUF_LEN 5

int main(int argc, char **argv)
{

char buf[BUF_LEN];

if (argc > 1)
{
 strcpy(buf, argv[1]);
}

 printf(buf);
 system("pause");
 return 0;
}

return 0; goes in the end. Otherwise the program execution stops there.

answered Dec 1, 2010 at 0:04

user418748

14 Comments

Eric Over a year ago

thanks,now it prints the buf but it still runs into the same problem by not outputing an error address.. Isn't this what I should get

user418748 Over a year ago

I dont think it is supposed to print an error address. more like a "SegFault" Thingy.

Eric Over a year ago

it doesnt print anything.. it prints the buf like there was no error, but when i press the any key to continue, it runs a Windows prompt load issue error I mentioned above and then closes

Eric Over a year ago

I make it at least more than buff, for example buff is now 5 in this program, so I make it "AAAAAAAA"

user418748 Over a year ago

Well you just end up writing on memory you shouldn't, thats all, and its not good. nothing really bad will happen unless you overwrite something usefull.

|

Adarsh Dinesh · Accepted Answer · 2012-07-05 02:45:49Z

0

On compiling use "gcc -fno-stack-protector -o out filename.c", because gcc contains inbuilt stack protector and u have to remove it. -fno-stack-protector will remove the protector function from gcc

edited Jul 5, 2012 at 2:45

answered Dec 28, 2011 at 11:47

Adarsh Dinesh

10612 bronze badges

Collectives™ on Stack Overflow

Buffer Overflow Problem

4 Answers 4

4 Comments

1 Comment

14 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

4 Comments

1 Comment

14 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related