Re: buffer overflow???

[markus-kern () GMX NET (Markus Kern)]

Cyber_Bob wrote:

*** overflow.c ***

char buf[15] = "AAAAAAAAAAAAAAA", buf2[256];
char diff;

int main(int argc, char *argv[])
{

  puts("I was just messing around trying to create some type of an
overflow");
  puts("and recieved a strange result which isn't supposed to happen...
somebody");
  puts("tell me what I'm experiencing... it's about 2 in the morning
right now");
  puts("so don't blame me if this looks crappy and thrown
together.\n");

  if (argc < 2) {
    printf("\nUsage: %s <offset (try something > 75)>\n\n", argv[0]);
    exit(-1);
  };

  diff = argv[1];       <= what are you doing here? diff is char, argv[1] is
char*

  puts("Enter A Line of Text..\n\n");
  scanf("%s", &buf2);

  printf("\nThat buffer was stored at: 0x%x", &buf2);
  printf("\nPreset buffer stored at: 0x%x\n\n", &buf);

  strcat(buf2, (&buf + diff));  <= ??? buf is practically a pointer.
You're adding
                                       diff to the address of the pointer

  printf("Weird Result: %s\n\n", buf2);

  return 0;
}

-- Markus