Thread: buffer overflow

  1. #1
    Registered User
    Join Date
    Sep 2020
    Posts
    3

    buffer overflow

    Im pretty new to c programming, but this program seems pretty simple. Its supposed to introduce some easy buffer overflow. I can spot the 14 bytes reserved for answer but actually being allowed 20 bytes pretty easily. Im wondering how can this be used to guess the value of the guess in the program?I have attached some sample output which has left me pretty confused. The printf's have been added by me to try and help me figure it out

    Code:
    int main()
    {
        int n = 0;
        int guess=0;
        char answer[14];
    
    
        srand(time(0)); 
        do {
            guess = rand();
        printf("actual is %d ", guess);
            printf("Input a number: ");
            fgets(answer,20,stdin);
        printf("actual is %d ", guess);
            n = atoi(answer);
        printf("");
        printf("guess is %d", n);
            if(n == guess) {
                break;
            } 
            printf("Incorrect! Guess again (y/n)? ");
            fgets(answer,4,stdin);
        }
        while(answer[0] == 'y');
    
    
        return 0;
    }

    buffer overflow-untitled-jpg
    Attached Images Attached Images buffer overflow-untitled-jpg 

  2. #2
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    38,416
    Try printing your guesses in hex.
    It's a bit more obvious which bytes of your guess are being messed with by your string overflow.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  3. #3
    Registered User
    Join Date
    Feb 2019
    Posts
    772
    It is not true if you allocate an array of 14 bytes it will ocuppy 14 bytes on stack... It can ocupy from 16 to 32 bytes, depending on optimizations, platform and alignment.

    It is not true that local objects of 'primitive' types are allocated on stack. They can be allocated on registers, by the compiler.

  4. #4
    Registered User
    Join Date
    Dec 2017
    Posts
    1,039
    This works for me (without optimizations).
    Code:
    #include <stdio.h>
    #include <stdlib.h>
    #include <time.h>
     
    int main()
    {
        int n = 0;
        int guess=0;
        char answer[14];
     
        srand(time(0)); 
        guess = rand();
     
        do {
            unsigned char *p = (unsigned char*)&guess;
            printf("actual is %d", guess);
            printf("  (%02x %02x %02x %02x)\n", p[0], p[1], p[2], p[3]);
     
            printf("Input a number: ");
            fgets(answer, 20, stdin); // enter: 808464432     0000
                                      // (that's 5 spaces before the zeroes)
            p = (unsigned char*)&guess;
            printf("actual is %d", guess);
            printf("  (%02x %02x %02x %02x)\n", p[0], p[1], p[2], p[3]);
     
            n = atoi(answer);
            printf("guess is %d\n", n);
            if (n == guess)
                break;
     
            printf("Incorrect! Guess again (y/n)? ");
            fgets(answer, 4, stdin);
        }
        while (answer[0] == 'y');
     
        return 0;
    }
    Note that the ascii code for '0' is 0x30, and 0x30303030 is 808464432.
    (Obviously I'm assuming 4-byte ints and that guess starts right after the 14-byte answer array, which seems to be the case for me.)

    Have you given up on the other program?
    Do you know the answer?
    If there is an online link associated with it, post it.

    Also, always post an entire program, complete with headers.
    And avoid posting pictures. Instead, copy and paste the text of terminal output.
    Last edited by john.c; 09-23-2020 at 07:49 AM.
    Philosophy is a battle against the bewitchment of our intelligence by means of language. - Wittgenstein

  5. #5
    Registered User
    Join Date
    Feb 2019
    Posts
    772
    One thing to notice on John's code:
    Code:
    ...
    int main()
    {
        int n = 0;
        int guess=0;
        char answer[14];
     
        srand(time(0)); 
        guess = rand();
     
        do {
            // this *probably* forces guess to be allocated on the stack,
            // because you cannot take an address of a register...
            unsigned char *p = (unsigned char*)&guess;
    
            printf("actual is %d", guess);
    
            // ... and you need to use that pointer somewhere, so the compiler,
            // don't optimize the code and get rid of it.
            printf("  (%02x %02x %02x %02x)\n", p[0], p[1], p[2], p[3]);
    
            printf("Input a number: ");
            fgets(answer, 20, stdin); // enter: 808464432     0000
                                      // (that's 5 spaces before the zeroes)
    ...
    Without that pointer trick, 'guess' could be allocated in a register and the code don't work.

    Anyway... it was a nice demonstration from John...

  6. #6
    Registered User
    Join Date
    Dec 2017
    Posts
    1,039
    @flp1969, that's an interesting point. However, without optimization, it still works even without the pointer (and getting rid of the printing of individual bytes). I think non-optimized code usually just sticks everything on the stack.

    Interestingly, with optimizations (-O2 on clang), it doesn't work even with the pointer. Although this could have been due to the value being stored on the stack in a different position so that the trick no longer works, looking at the assembly code, it actually keeps the main value in a register and stores the separate bytes in four other registers! (The pointer disappears.)

    There's no easy way to know what's going on under the hood these days without actually looking.
    Philosophy is a battle against the bewitchment of our intelligence by means of language. - Wittgenstein

  7. #7
    Registered User
    Join Date
    Feb 2019
    Posts
    772
    Quote Originally Posted by john.c View Post
    There's no easy way to know what's going on under the hood these days without actually looking.
    Code:
    ███████████████████████████████████████
    █████████████▓▒░░░░░░░░▒███████████████
    ███████████▓░░░░░░░░░░░░░▒█████████████
    ██████████▒░░░▓▓░░░░░░░░░░░▓███████████
    █████████░░░░████░░░░░░░░░░░▒██████████
    ████████░░░░▓█┌┌██░░░░░░░░░░░░█████████
    ███████░░░░░█▓┌┌┌██░░░░░░░░░░░▒████████
    ██████░░░░░░▓▓┌┌┌┌█▒░░░░░░░░░░░▓███████
    ████▓░░░░░░░░█┌┌┌┌┌█░░░░░░░░░░░░░██████
    ████░░░░░░░░░█▒┌┌┌┌█▓░░░░░░░░░░░░▓█████
    ███▓░░░░░░░░░█▓┌┌┌┌▓█░░░░░░░░░░░░░█████
    ███░░░░░░░░░░▓█┌┌┌┌░█░░░░░░░░░░░░░▓████
    ██▓░░░░░░░░░░▓█┌┌┌┌▒█░░░░░░░░░░░░░░████
    ██▒░░░░░░░░░░▒█┌┌┌┌▓█░░░░░░░░░░░░░░▓███
    ██░░░░░░░░░░░▒█┌┌┌┌▓▓░░░░░░░░░░░░░░▒███
    █▓░░░░░░░░░░░▓█┌┌┌┌█▓░░▒▒▒░░░░░░░░░░███
    █▒░░░░░░░░░░░█▓┌┌┌┌▓█████████▓░░░░░░███
    █░░░░░░░░░░░░█░┌┌┌┌┌█▒┌┌┌┌░▒███▓░░░░███
    █░░░░░░░░░░░▓█┌┌┌┌┌┌█┌┌┌┌░▓▓┌┌▒██░░░███
    █░░░░░░░░░░░█▒┌┌┌┌┌┌█░┌▓██▓▒┌┌┌┌██░░███
    █░░░░░░░░░░▓█┌┌┌┌┌┌┌█┌▓█▒┌┌┌┌┌┌┌┌█░░███
    █░░░░░░░░░▒█┌┌┌┌┌┌┌░██▓┌┌┌┌┌┌┌┌┌░█░░███
    █░░░░░░░░░█▓┌┌┌┌┌┌┌████┌┌┌┌┌┌┌┌▒█▓░░███
    █░░░░░░░░░█░┌┌┌┌┌┌┌█░┌██▒┌┌┌▒██▓▒█░░███
    █░░░░░░░░▒█┌┌┌┌┌┌┌┌┌┌┌░███████░┌┌█▒░███
    █░░░░░░░░▓█┌┌┌┌┌┌┌┌┌┌▒█┌┌┌┌┌┌┌┌┌┌▓▓░███
    █░░░░░░░░█▓┌┌┌┌┌┌┌┌┌▓█┌┌┌┌┌┌┌┌┌┌┌█▓░███
    █░░░░░████▒┌┌┌┌┌┌┌┌┌░█┌┌┌┌┌┌┌┌┌▒██░░███
    █░░░░▓██▓█┌┌┌┌┌┌┌┌┌┌┌██▓░┌░▒▓██▓█▓░░███
    █░░░░██┌┌█┌┌┌┌┌┌┌┌┌┌░▓▒██████▓┌┌┌█░░███
    █▓░░░█▒┌░█┌┌┌┌┌┌┌┌┌┌▓█┌┌┌┌┌┌┌┌┌┌▒█░░███
    ██░░░█▒┌┌█┌┌┌┌┌┌┌┌┌▓███┌┌┌┌┌┌┌┌┌█▓░▒███
    ██▒░░▓▓┌┌█▒┌┌┌┌┌┌┌┌█░┌██▒┌┌┌┌┌░██░░████
    ███░░▒█┌┌▒█┌┌┌┌┌┌┌┌█┌┌┌▓███▓████▒░░████
    ███░░░█▓┌┌█▓┌┌┌┌┌┌┌█▒┌┌┌┌▓███▓░█░░▓████
    ███▓░░▒█┌┌┌█▓┌┌┌┌┌┌▒█┌┌┌┌┌┌┌┌┌▓█░░█████
    █████░░░█▓┌┌┌▓██▓┌┌┌┌█▓░┌┌┌▒██▒░░██████
    █████▓░░░██┌┌┌█████▒┌┌▓█████▓░░░███████
    ██████░░░░█████▒░▒████████▓░░░░▓███████
    ███████░░░░▓██▓░░░░░░▒▒░░░░░░░▒████████
    ████████░░░░░░░░░░░░░░░░░░░░░▒█████████
    ██████████▒░░░░░░░░░░░░░░░░▓███████████
    ████████████▒░░░░░░░░░░░░▒█████████████

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Buffer Overflow
    By AlexTank853 in forum C Programming
    Replies: 3
    Last Post: 09-25-2013, 04:14 PM
  2. buffer overflow detected
    By baxy in forum C Programming
    Replies: 8
    Last Post: 10-12-2012, 12:35 PM
  3. buffer overflow
    By cpp_is_fun in forum C Programming
    Replies: 2
    Last Post: 10-24-2006, 11:04 PM
  4. Buffer overflow errors
    By EvBladeRunnervE in forum C Programming
    Replies: 2
    Last Post: 03-17-2004, 04:58 PM

Tags for this Thread