0

Does someone know why the following lines of code throws a *** stack smashing detected *** error

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
  char x[16];
  strcpy(x,"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
}

but the following code does not throw it?

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
    char x[16];
    x[17] = 'a';
}

Thank you!!

ronce96
  • 84
  • 2
  • 9
  • The behavior is undefined in both cases. – EOF Oct 13 '18 at 18:39
  • I dont understand that. What do you mean by undefined? @EOF – ronce96 Oct 13 '18 at 19:03
  • "Undefined" means that *anything* may happen. The compiler is not obligated to emit code that will crash, and it is not obligated to emit code that will actually execute the out-of-bounds accesses. *Anything* can happen, and the compiler is not required to be consistent about it. For example, my `gcc` with `-O3` completely optimizes away the out-of-bounds accesses and thus avoids even emitting stack-cookie code at all. – EOF Oct 14 '18 at 14:37

1 Answers1

3

Overwriting x[17] doesn't overwite the canary-value put before the return address by gcc.

Swordfish
  • 12,971
  • 3
  • 21
  • 43