缓冲区溢出代码实例总结

1

 

#include <stdio.h>

#define PASSWORD "1234567"

int verify_password (char *password)
{
   int authenticated;
   char buffer[8]; // add local buffto be overflowed
   authenticated=strcmp(password,PASSWORD);
   strcpy(buffer,password); // over flowed here!
   return authenticated;
}
main()
{
   int valid_flag=0;
   char password[1024];
   while(1)
   {
      printf("please input password: ");
      scanf("%s", password);
      valid_flag=verify_password(password);
      if(valid_flag)
      {
         printf("incorrect password!\n\n");
      }
      else
      {
         printf("Congratulation! You have passed the verification!\n");
         break;
      }
   }
}

如果输入的密码超过7个字符，（注意字符串截断符NULL将占用一个字节），则越界字符的ASCII码会修改掉authenticated的值。如果这段溢出数据恰好把authenticated改为0，则程序流程将被改变。

 

 

 

 <