C Board  

Go Back   C Board > General Programming Boards > C Programming

Reply
 
LinkBack Thread Tools Display Modes
Old 03-26-2005, 01:56 PM   #1
Registered User
 
Join Date: Feb 2005
Posts: 38
Segmentation fault

Here's the deal I'm not getting a segmentation fault when I'm suppose to.

Code:
#include <stdio.h> 
 
int call_me(void) 
{ 
  char buffer[10]; 
  scanf("%s", buffer); 
  printf("%s\n", buffer); 
  return 0; 
} 
 
int main(void) 
{ 
  call_me(); 
  return 0; 
}
Memory is accessed in words (4 bytes or 32 bits) so buffer[10] is really 12 bytes. Ok, so anything over 12 should overflow it and give a segmentation fault, correct? Well, this is not the case....

Code:
[nouse@localhost nouse]$ gcc -o vuln vuln.c
[nouse@localhost nouse]$ ./vuln
AAAABBBBCCCCDDDD
AAAABBBBCCCCDDDD
[nouse@localhost nouse]$ ./vuln
AAAABBBBCCCCDDDDEEEE
AAAABBBBCCCCDDDDEEEE
[nouse@localhost nouse]$ ./vuln
AAAABBBBCCCCDDDDEEEEFFFF
AAAABBBBCCCCDDDDEEEEFFFF
Segmentation fault
[nouse@localhost nouse]$
So the first attempt I use 16 bytes which should overflow the buffer (12 bytes) and sfp (saved frame pointer (4 bytes)) there after. Doesn't do it. Next, I use 20 bytes, which should overflow the buffer, spf, and ret (saved ip (4 bytes)). Finally, after 24 bytes I get a seg fault. 24 bytes to overflow a 12 byte buffer? What's going on?

Also, gdb isn't working with me either. I try to check my registers to see what's going on but it says there arn't any.

Code:
[nouse@localhost nouse]$ gdb vuln
GNU gdb 5.3-22mdk (Mandrake Linux)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux-gnu"...
(gdb) info registers
The program has no registers now.
(gdb)
I must be missing something? Thanks for any help.

Last edited by NoUse; 03-26-2005 at 02:05 PM.
NoUse is offline   Reply With Quote
Old 03-26-2005, 02:28 PM   #2
Gawking at stupidity
 
Join Date: Jul 2004
Posts: 2,289
It's not guaranteed to generate a segfault if you write past the end of a buffer. It's just guaranteed to give "undefined results". Why are you trying to define an undefined result? There's no purpose in this type of exercise unless you're trying to do something malicious or some pointless trick.

EDIT: BTW, the reason "gdb isn't working" is because you're using it incorrectly. The program has to be running to get register information. Try using breakpoints.

Something like this:
Code:
itsme@itsme:~/C$ gdb malicious
GNU gdb 6.1.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) list
4       {
5         char buffer[10];
6         scanf("%s", buffer);
7         printf("%s\n", buffer);
8         return 0;
9       }
10
11      int main(void)
12      {
13        call_me();
(gdb) break 6
Breakpoint 1 at 0x80483ba: file malicious.c, line 6.
(gdb) break 7
Breakpoint 2 at 0x80483cd: file malicious.c, line 7.
(gdb) run
Starting program: /home/itsme/C/malicious

Breakpoint 1, call_me () at malicious.c:6
6         scanf("%s", buffer);
(gdb) info registers
eax            0x10     16
ecx            0x4      4
edx            0xb7fd0b40       -1208153280
ebx            0xb7fcf60c       -1208158708
esp            0xbffff720       0xbffff720
ebp            0xbffff748       0xbffff748
esi            0xb8000900       -1207957248
edi            0xbffff7b4       -1073743948
eip            0x80483ba        0x80483ba
eflags         0x282    642
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x0      0
(gdb) continue
Continuing.
foo

Breakpoint 2, call_me () at malicious.c:7
7         printf("%s\n", buffer);
(gdb) info registers
eax            0x1      1
ecx            0x0      0
edx            0x1      1
ebx            0xb7fcf60c       -1208158708
esp            0xbffff720       0xbffff720
ebp            0xbffff748       0xbffff748
esi            0xb8000900       -1207957248
edi            0xbffff7b4       -1073743948
eip            0x80483cd        0x80483cd
eflags         0x246    582
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x0      0
(gdb) quit
__________________
If you understand what you're doing, you're not learning anything.

Ignore any "advice" esbo tries to give you. It's wrong.

Last edited by itsme86; 03-26-2005 at 02:39 PM.
itsme86 is offline   Reply With Quote
Old 03-26-2005, 03:03 PM   #3
Registered User
 
Join Date: Feb 2005
Posts: 38
Quote:
Originally Posted by itsme86
It's not guaranteed to generate a segfault if you write past the end of a buffer. It's just guaranteed to give "undefined results". Why are you trying to define an undefined result? There's no purpose in this type of exercise unless you're trying to do something malicious or some pointless trick.

EDIT: BTW, the reason "gdb isn't working" is because you're using it incorrectly. The program has to be running to get register information. Try using breakpoints.

Something like this:
Code:
itsme@itsme:~/C$ gdb malicious
GNU gdb 6.1.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) list
4       {
5         char buffer[10];
6         scanf("%s", buffer);
7         printf("%s\n", buffer);
8         return 0;
9       }
10
11      int main(void)
12      {
13        call_me();
(gdb) break 6
Breakpoint 1 at 0x80483ba: file malicious.c, line 6.
(gdb) break 7
Breakpoint 2 at 0x80483cd: file malicious.c, line 7.
(gdb) run
Starting program: /home/itsme/C/malicious

Breakpoint 1, call_me () at malicious.c:6
6         scanf("%s", buffer);
(gdb) info registers
eax            0x10     16
ecx            0x4      4
edx            0xb7fd0b40       -1208153280
ebx            0xb7fcf60c       -1208158708
esp            0xbffff720       0xbffff720
ebp            0xbffff748       0xbffff748
esi            0xb8000900       -1207957248
edi            0xbffff7b4       -1073743948
eip            0x80483ba        0x80483ba
eflags         0x282    642
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x0      0
(gdb) continue
Continuing.
foo

Breakpoint 2, call_me () at malicious.c:7
7         printf("%s\n", buffer);
(gdb) info registers
eax            0x1      1
ecx            0x0      0
edx            0x1      1
ebx            0xb7fcf60c       -1208158708
esp            0xbffff720       0xbffff720
ebp            0xbffff748       0xbffff748
esi            0xb8000900       -1207957248
edi            0xbffff7b4       -1073743948
eip            0x80483cd        0x80483cd
eflags         0x246    582
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x0      0
(gdb) quit
I wasn't saying "gdb isn't working" I was saying "gdb isn't working for me" implying that I'm doing something wrong, so no need to be so condescending. I appreciate you help though. Also, I figured out that it isn't entirely necessary to set breakpoints, all you have to do is "run" it.

Also, I'm not doing anything malicious. Just learning.

Good day. Thanks again for your help.

Last edited by NoUse; 03-26-2005 at 03:09 PM.
NoUse is offline   Reply With Quote
Old 03-26-2005, 03:14 PM   #4
Gawking at stupidity
 
Join Date: Jul 2004
Posts: 2,289
I wasn't trying to be condescending. I suggested breakpoints so you could check the registers at specific lines in your code. Just make sure you compile your program with the -g option.
__________________
If you understand what you're doing, you're not learning anything.

Ignore any "advice" esbo tries to give you. It's wrong.
itsme86 is offline   Reply With Quote
Old 03-26-2005, 03:29 PM   #5
Registered User
 
Join Date: Feb 2005
Posts: 38
Oh I see. Thanks.
__________________
I like to play pocket pool.
NoUse is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
segmentation fault... first time with unix... theMethod C Programming 16 09-30-2008 02:01 AM
Re: Segmentation fault turkish_van C Programming 8 01-20-2007 05:50 PM
Segmentation fault bennyandthejets C++ Programming 7 09-07-2005 05:04 PM
Locating A Segmentation Fault Stack Overflow C Programming 12 12-14-2004 01:33 PM
Segmentation fault... alvifarooq C++ Programming 14 09-26-2004 12:53 PM


All times are GMT -6. The time now is 06:16 AM.


Powered by vBulletin® Version 3.8.1
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.3.0 RC2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22