c - Buffer Overflow Problem

Question

I am trying to run a buffer overflow example to run some code, but the problem is that when I try to run the code just to get a buffer overflow, Windows throws a prompt up stating "Program has stopped working, Windows is checking for a solution to the program. So when I try to make sure it just has a overflow by one byte. The program just runs, but doesn't pause the command window in order for me to see the segmentation fault error address. Which to my understanding I would need in order to change it and make it run my desired window as the passed parameter.Here is the simple program.

#define BUF_LEN 5

int main(int argc, char **argv)
{

char buf[BUF_LEN];

if (argc > 1)
{
 strcpy(buf, argv[1]);
}
 return 0;
 printf(buf);
 system("pause");
}

Answer 1

Segmentation faults are just one manifestation of undefined behaviour. There is really nothing that guarantees you that the OS will give you any information about what went wrong here.

You don't need the address in order to diagnose the segfault anyway. There is exactly one thing that can cause a buffer overflow here and you know exactly what it is: the strcpy() call.

Assuming you must use C, the fix is to use strncpy() instead.

Answer 2

The problem lies with the fact that buffer overflow behavior is not standardized - your example may refer to an older version of Windows, which still printed an error address, or to a completely different operating system.

Additionally, not all buffer overflows cause the program to crash - it depends on what data is written where. For small buffer overflows, you may be overwriting only some other local variables or padding space, instead of anything essential for the program execution (like the function return address).

Answer 3

#define BUF_LEN 5

int main(int argc, char **argv)
{

char buf[BUF_LEN];

if (argc > 1)
{
 strcpy(buf, argv[1]);
}

 printf(buf);
 system("pause");
 return 0;
}

return 0; goes in the end. Otherwise the program execution stops there.

Answer 4

On compiling use "gcc -fno-stack-protector -o out filename.c", because gcc contains inbuilt stack protector and u have to remove it. -fno-stack-protector will remove the protector function from gcc