The output of the code below is "Overflow", but I didn't explicitly call the func
function. How does it work?
#include<stdio.h>
#include<string.h>
#include<stdlib.h>
int copy(char *input)
{
char var[20];
strcpy(var, input);
return 0;
}
int func(void)
{
printf("Overflow\n");
return 0;
}
int main(int argc, char *argv[])
{
char str[] = "AAAABBBBCCCCDDDDEEEEFFFFGGGG";
int *p = (int *)&str[24];
*p = (int)func;
copy(str);
return 0;
}
The copy
function overflows the var
buffer in the copy
function and overwrites the main
return address with the address of the func
function.
When copy
function returns, instead of returning to main
after the copy
function call, it returns to func
function.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With