Smashing The Stack

Hi all.

I have a program like this:

Code:

---

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int check(char *password){
        int auth_flag = 0;
        char passw_buffer[16];

        strcpy(passw_buffer,password);

        if(strcmp(passw_buffer,"brullig") == 0)
                auth_flag = 1;
        if(strcmp(passw_buffer,"outgrabe") == 0)
                auth_flag = 1;

        return auth_flag;
}
int main(int argc, char *argv[]){

        if(check(argv[1]))
                printf("Access granted\n");
        else
                printf("Access denied\n");

        return 0;
}

---

When I enter a big string in command-line, I get this:

Code:

---

spitz@nerdbox:~/Documents/BP> ./auth_overflow AAAAAAAAAAAAAAAAAAAAA
Access granted

---

I understand it, because my stack looks like this:

[Bottom of stack/High Memory Adresses] auth_flag | buffer [top of stack / lower memory adresses].

But then I switch auth_flag en buffer declaration like this:

Code:

---

int check(char *password){

        char passw_buffer[16];
        int auth_flag = 0;

        strcpy(passw_buffer,password);

        if(strcmp(passw_buffer,"brullig") == 0)
                auth_flag = 1;
        if(strcmp(passw_buffer,"outgrabe") == 0)
                auth_flag = 1;

        return auth_flag;
}
int main(int argc, char *argv[]){

        if(check(argv[1]))
                printf("Access granted\n");
        else
                printf("Access denied\n");

        return 0;
}

---

When I run it again with a long string I get this:

Code:

---

spitz@nerdbox:~/Documents/BP> ./auth_overflow2 AAAAAAAAAAAAAAAAAAAAA
Access granted

---

How is it possible that the AAAA has overwritten the auth_flag int?

I tought the stack in the second example would look like this:

[Bottom Of Stack/High Memory Addresses] buffer | auth_flag [Top of Stack/ Low memory adresses]


Can anyone explain me how it's possible that auth_flag got overwritten?


Thanks in advance!

PS: I'm using OpenSUSE 11.1, gcc version 4.3

Why don't you use gcc -S to understand what the actual code does, and see how it is arranged yourself?

--
Mats