Re: why dosent buffer gets overflowed

raashid bhatt said:

On Aug 22, 3:31 am, James Kuyper <jameskuy...@xxxxxxxxxxx> wrote:
raashid bhatt wrote:
On Aug 21, 10:45 pm, Richard Heathfield <r...@xxxxxxxxxxxxxxx> wrote:
<snip>

What makes you think the buffer isn't being overflowed?
...
i am using a debugger to track EIP but its this program exits nornally

So, why does that make you think that the buffer isn't being overflowed?

i mean if buffer gets overflowed then EIP should contains my A's and
as per as definition of EIP (pointer to code) which contains A's
should cause the program to crash

Wrong. If the buffer is overflowed, then the C Standard imposes NO
REQUIREMENTS on what should happen - that's what "undefined behaviour"
means. The "it should do this" behaviour you describe is one possibility,
but only one among infinitely many. The program is *not* required to
behave as you expect. What happens is outside the control of the C
language. Your implementation can do anything it likes.

--
Richard Heathfield <http://www.cpax.org.uk>
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999
.

Relevant Pages

  • Re: Simple Buffer Overflow
    ... pass a randomely large string (1000 chars, ... able to find the substring (4 chars that overwrite the EIP). ... I'm new in the pen-test area and want to study a simple buffer overflow exploit on debian 2.6.18-5-686. ... As I've said I'm new to this field and my goal is to be able to anticipate on possible buffer overflow exploits. ...
    (Pen-Test)
  • [NT] WFTPD Multiple Buffer Overflows (CWD, DELE, MDTM, MKD, RMD, MLST, RNFR, SIZE, XCWD, XMKD, XRMD)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WFTPD Multiple Buffer Overflows (CWD, DELE, MDTM, MKD, RMD, MLST, RNFR, ... vulnerabilities have been found in WFTPD server allowing remote attackers ... execute arbitrary code by overflowing its EIP register, ...
    (Securiteam)
  • Re: Accessing program counter registers from within C or Aseembler.
    ... > current executing instruction in C while the program ... execute code to get that EIP, you end up getting the EIP ... Make some code to load code into that buffer. ...
    (Linux-Kernel)
  • Re: Questions about C1x
    ... But where does the standard say that it's undefined behaviour? ... This is a buffer overflow where there isn't any access to the ... The standard is always right. ...
    (comp.std.c)
  • Re: Buffer overflows and asctime()
    ... those inputs that make this version return a null pointer, the C99 version invokes undefined behaviour by overflowing its buffer. ... The only change is that currently the undefined behaviour *allows* asctimeto return a null pointer, whereas this version, if pasted into the standard, would *require* it. ... But of course it can return a null pointer, if you have invoked undefined behaviour by giving it values that make the C99 sample implementation overflow its buffer. ...
    (comp.std.c)