Hello Can you give me a sample code for overflow in stack with c or .net ? and say me how do you resolve this bug.
Thank you
1
-
2The resolution is easy. Just don't do whatever the sample does.Ignacio Vazquez-Abrams– Ignacio Vazquez-Abrams2011-03-14 08:22:17 +00:00Commented Mar 14, 2011 at 8:22
Add a comment
|
4 Answers
How about:
static void f(void) {
f();
}
int main (void) {
f();
return 0;
}
That should give you a very nice stack overflow, the solution to which is: don't do that.
Comments
#include <string.h>
void function( char *str ) {
char buf[8];
strcpy(buffer,str);
}
void main( int argc, char *argv[] ) {
function( argv[1] );
}
Classic example. strcpy() copies without checking any sizes. So, if your source string (str) is bigger than the buffer (buf) you will get a buffer overflow. Making it say 16chars you will get a stack overflow.
You can resolve this bug by using a safer function like strncpy.
Comments
int factorial(int x)
{
if (x == 1 || x == 0) return 1;
return factorial(x-1) * x;
}
factorial(-1);
Make sure recursive functions always reach a base case somehow.
int factorial(int x)
{
if (x < 0) return 0;
if (x == 1 || x == 0) return 1;
return factorial(x-1) *x;
}
factorial(-1);
4 Comments
Ignacio Vazquez-Abrams
This will not recurse forever.
paxdiablo
Ooh, good catch, @Ignacio. jon_d, you should use
== rather than = :-)paxdiablo
Actually, it may not overflow anyway if tail end recursion optimisation happens. But, then again, my answer could have the call to
f() optimised out of existence since it does nothing :-)
jon_darkstar
figured id make it non-trivial while i was at it
Do you mean running out of stack space, or doing something malicious?
The classic article on overflowing the stack maliciously:
http://insecure.org/stf/smashstack.html
If you mean just running out of stack space, all you need to do is have a recursive function that ends up allocating too much space on the stack, and running out:
int foo()
{
int something = 4;
foo();
return something; /* Yeah, we never get here */
}
3 Comments
paxdiablo
Technically, that's a buffer overflow rather than a stack overflow, but it's a damn good article nonetheless.
jon_darkstar
i dont think he means buffer overflow, but thanks for posting that article! i hadnt seen it before
Brian Roach
He said stack ... I just edited with a recursive func that will eventually run out.