Questions tagged [buffer-overflow]

Usually occurs when you attempt to copy data into a buffer without checking for sufficient space, causing data to be overwritten in neighboring cells.

RAM is divided into memory cells with each cell capable of storing a single byte on it's own. Applications use different sizes of the same data type to fulfill their computational needs, which can vary between a single or multiple (arrays) or dynamically allocated (pointers). Problems usually arise when software developers employ the use of arrays or pointers without verifying the destination buffer has sufficient or adequate space.

char Target[10];
char Input[20];
strcpy( Target, Input); // 1st Parameter: Destination, 2nd Parameter: Data

The code listed above plus certain conditions can exhibit the buffer-overflow corruption. If the coder doesn't take the necessary precautions to validate target/input, it will result in data being fed into adjacent memory cells corrupting whatever contents is stored within them.

Such results can be devastating as they affect overall system integrity.

1483 questions
9
votes
4 answers

Create buffer overflows in snow leopard

As part of a course at university in computer security, I'm soon about to learn about buffer overflows and how to use them to as exploits. I'm trying to do some simple buffer overflow with the following code: #include #include…
9
votes
2 answers

Why address sanitizer doesn't work for bss global overflow?

What I have done. Test1 1 #include 2 3 int test[16]; …
Alex Hoppus
  • 3,821
  • 4
  • 28
  • 47
9
votes
6 answers

What are the prevention techniques for the Buffer overflow attacks?

what are the ideas of preventing buffer overflow attacks? and i heard about Stackguard,but until now is this problem completely solved by applying stackguard or combination of it with other techniques? after warm up, as an experienced programmer…
berkay
  • 3,907
  • 4
  • 36
  • 51
9
votes
2 answers

Android MediaRecorder Sampling Rate and Noise

I have an issue using Android's MediaRecorder to record sound from microphone to .m4a files (AAC-LC, MPEG-4 container). Starting from API level 18, the default sampling rate drops from 44.1 or 48 kHz (depending on device) to only 8 Hz. If I…
user4672580
9
votes
2 answers

Simple buffer overflow and shellcode example

I've been trying to run Aleph One's example in order to get a BOF and open a shell. This is Aleph One paper: http://insecure.org/stf/smashstack.html And this is the simple C code (located nearly at the half of the paper): char shellcode[]…
Jjang
  • 11,250
  • 11
  • 51
  • 87
9
votes
3 answers

Attempting a buffer overflow

I am attempting to change the result of a function using a buffer overflow to change the results on the stack with the following code: #include #include #include int check_auth1(char *password) { char…
orange
  • 5,297
  • 12
  • 50
  • 71
9
votes
2 answers

Compile C to allow for Buffer Overflow

I am learning about buffer overflows and am trying to make one. I have this code: #include char *secret = "password"; void go_shell() { char *shell = "/bin/sh"; char *cmd[] = { "/bin/sh", 0 }; setreuid(0); …
carloabelli
  • 4,289
  • 3
  • 43
  • 70
9
votes
2 answers

Smashing the stack example3.c confusion

Article can be found here. I'm reading up on smashing the stack and have found myself to be getting stuck on example3.c. 0x80004a3 : call 0x8000470 0x80004a8 : addl $0xc,%esp 0x80004ab : movl …
user1529891
8
votes
1 answer

buffer overflow example from Art of Exploitation book

I was reading this book Art of Exploitation, which is kinda good book and I run across that example from exploit_notesearch.c file. Briefly author tries to overflow program from notesearch.c int main(int argc, char *argv[]) { int userid,…
Rustam Issabekov
  • 3,279
  • 6
  • 24
  • 31
8
votes
1 answer

return to libc - problem

I'm having problems with return-to-libc exploit. The problem is that nothing happens, but no segmentation fault (and yes I'm actually overflowing the stack). This is my program: int main(int argc, char **argv) { char array[512]; …
eleanor
  • 1,514
  • 3
  • 19
  • 40
8
votes
3 answers

buffer overflow exploit: Why does "jmp esp" need to be located in a DLL?

I am trying to understand classical buffer overflow exploits where an input buffer overwrites the stack, the function return address that is saved on the stack and upper memory regions (where you usually place the shell code). There are many…
kaidentity
  • 609
  • 4
  • 10
  • 26
8
votes
3 answers

Stack Overflow Exploit in C

The question is actually about stack overflows in C. I have an assigment that I can not get done for the life of me, I've looked at everything in the gdb and I just cant figure it. The question is the following: int i,n; void confused() { …
Fernando Gonzalez
8
votes
6 answers

How to write a buffer-overflow exploit in GCC,windows XP,x86?

void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *ret; ret = buffer1 + 12; (*ret) += 8;//why is it 8?? } void main() { int x; x = 0; function(1,2,3); x = 1; printf("%d\n",x); } The above demo…
Mask
  • 33,129
  • 48
  • 101
  • 125
8
votes
6 answers

How to conduct buffer overflow in PHP/Python?

Here is an example in c: #include #include void bad() { printf("Oh shit really bad~!\r\n"); } void foo() { char overme[4] = "WOW"; *(int*)(overme+8) = (int)bad; } int main() { foo(); }
user198729
  • 61,774
  • 108
  • 250
  • 348
8
votes
2 answers

AudioRecord: buffer overflow?

I'm getting buffer overflow while RECORDING with my app. The recording is performed in a Service. I could not figure out why I'm getting this message from AudioFlinger. Below I instantiate the AudioRecord object and set it's callbacks. bufferSize =…