argv溢出

argc和argv是主函数运行的input。

argv溢出现象：

#include<iostream>
using namespace std;
int main(int argc, char**argv){
	//int i=argc
	argv[argc]="1";
	for(int i=0; argv[i]; i++){
		cout << argv[i] << endl;
	}
	return 0;
}

因为修改了argv边界元素，使循环无法在原来的边界停止，而继续输出。输出的内容是什么？
输出：

./a.out 1 SHELL=/bin/bash ROS_VERSION=2
SESSION_MANAGER=local/changxianrui-ThinkStation-K-C2:@/tmp/.ICE-unix/2698,unix/changxianrui-ThinkStation-K-C2:/tmp/.ICE-unix/2698
QT_ACCESSIBILITY=1 COLORTERM=truecolor
XDG_CONFIG_DIRS=/etc/xdg/xdg-ubuntu:/etc/xdg XDG_MENU_PREFIX=gnome-
no_proxy=localhost,127.0.0.0/8,::1
GNOME_DESKTOP_SESSION_ID=this-is-deprecated GTK_IM_MODULE=fcitx
ROS_PYTHON_VERSION=3 LANGUAGE=zh_CN:en QT4_IM_MODULE=fcitx
LC_ADDRESS=zh_CN.UTF-8 GNOME_SHELL_SESSION_MODE=ubuntu
LC_NAME=zh_CN.UTF-8 SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
XMODIFIERS=@im=fcitx DESKTOP_SESSION=ubuntu LC_MONETARY=zh_CN.UTF-8
SSH_AGENT_PID=2657 GTK_MODULES=gail:atk-bridge
PWD=/home/changxianrui/cxr/c++ XDG_SESSION_DESKTOP=ubuntu LOGNAME=changxianrui
XDG_SESSION_TYPE=x11
GPG_AGENT_INFO=/run/user/1000/gnupg/S.gpg-agent:0:1
XAUTHORITY=/run/user/1000/gdm/Xauthority
ftp_proxy=http://127.0.0.1:7890/ NMEDIA_LOG_LEVEL=WARN
GJS_DEBUG_TOPICS=JS ERROR;JS LOG WINDOWPATH=2 HOME=/home/changxianrui
USERNAME=changxianrui IM_CONFIG_PHASE=1 LC_PAPER=zh_CN.UTF-8
LANG=zh_CN.UTF-8
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:.tar=01;31:.tgz=01;31:.arc=01;31:.arj=01;31:.taz=01;31:.lha=01;31:.lz4=01;31:.lzh=01;31:.lzma=01;31:.tlz=01;31:.txz=01;31:.tzo=01;31:.t7z=01;31:.zip=01;31:.z=01;31:.dz=01;31:.gz=01;31:.lrz=01;31:.lz=01;31:.lzo=01;31:.xz=01;31:.zst=01;31:.tzst=01;31:.bz2=01;31:.bz=01;31:.tbz=01;31:.tbz2=01;31:.tz=01;31:.deb=01;31:.rpm=01;31:.jar=01;31:.war=01;31:.ear=01;31:.sar=01;31:.rar=01;31:.alz=01;31:.ace=01;31:.zoo=01;31:.cpio=01;31:.7z=01;31:.rz=01;31:.cab=01;31:.wim=01;31:.swm=01;31:.dwm=01;31:.esd=01;31:.jpg=01;35:.jpeg=01;35:.mjpg=01;35:.mjpeg=01;35:.gif=01;35:.bmp=01;35:.pbm=01;35:.pgm=01;35:.ppm=01;35:.tga=01;35:.xbm=01;35:.xpm=01;35:.tif=01;35:.tiff=01;35:.png=01;35:.svg=01;35:.svgz=01;35:.mng=01;35:.pcx=01;35:.mov=01;35:.mpg=01;35:.mpeg=01;35:.m2v=01;35:.mkv=01;35:.webm=01;35:.ogm=01;35:.mp4=01;35:.m4v=01;35:.mp4v=01;35:.vob=01;35:.qt=01;35:.nuv=01;35:.wmv=01;35:.asf=01;35:.rm=01;35:.rmvb=01;35:.flc=01;35:.avi=01;35:.fli=01;35:.flv=01;35:.gl=01;35:.dl=01;35:.xcf=01;35:.xwd=01;35:.yuv=01;35:.cgm=01;35:.emf=01;35:.ogv=01;35:.ogx=01;35:.aac=00;36:.au=00;36:.flac=00;36:.m4a=00;36:.mid=00;36:.midi=00;36:.mka=00;36:.mp3=00;36:.mpc=00;36:.ogg=00;36:.ra=00;36:.wav=00;36:.oga=00;36:.opus=00;36:.spx=00;36:*.xspf=00;36:
XDG_CURRENT_DESKTOP=ubuntu:GNOME VTE_VERSION=6003
AMENT_PREFIX_PATH=/opt/ros/foxy
GNOME_TERMINAL_SCREEN=/org/gnome/Terminal/screen/5616b40b_bc6c_40e4_80f1_19ee6dd64de8
https_proxy=http://127.0.0.1:7890/
INVOCATION_ID=481664c368434af3a4c48d48f983625d MANAGERPID=2556
CLUTTER_IM_MODULE=fcitx GJS_DEBUG_OUTPUT=stderr
CPPTEST_CONTAINER_NAME=u20cross1.4 LESSCLOSE=/usr/bin/lesspipe %s %s
XDG_SESSION_CLASS=user
PYTHONPATH=/opt/ros/foxy/lib/python3.8/site-packages
TERM=xterm-256color LC_IDENTIFICATION=zh_CN.UTF-8 LESSOPEN=|
/usr/bin/lesspipe %s USER=changxianrui NO_PROXY=localhost,127.0.0.0/8,::1
FTP_PROXY=http://127.0.0.1:7890/ NMEDIA_LOG_METHOD=MINILOG
GNOME_TERMINAL_SERVICE=:1.119 DISPLAY=:1 SHLVL=1
LC_TELEPHONE=zh_CN.UTF-8 HTTPS_PROXY=http://127.0.0.1:7890/
HTTP_PROXY=http://127.0.0.1:7890/ QT_IM_MODULE=fcitx
LC_MEASUREMENT=zh_CN.UTF-8 PAPERSIZE=a4
http_proxy=http://127.0.0.1:7890/
LD_LIBRARY_PATH=/opt/ros/foxy/opt/yaml_cpp_vendor/lib:/opt/ros/foxy/opt/rviz_ogre_vendor/lib:/opt/ros/foxy/lib/x86_64-linux-gnu:/opt/ros/foxy/lib
XDG_RUNTIME_DIR=/run/user/1000 ROS_LOCALHOST_ONLY=0
ALL_PROXY=socks://127.0.0.1:7890/ LC_TIME=zh_CN.UTF-8
JOURNAL_STREAM=8:94023
XDG_DATA_DIRS=/usr/share/ubuntu:/usr/local/share/:/usr/share/:/var/lib/snapd/desktop
all_proxy=socks://127.0.0.1:7890/
PATH=/opt/ros/foxy/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/home/changxianrui/cpptest:/home/changxianrui/cpptest/bin:/opt/nodejs/node-v18.12.1-linux-x64/bin/:/opt/nodejs/node-v18.12.1-linux-x64/bin/:/opt/nodejs/node-v18.12.1-linux-x64/bin/:/opt/nodejs/node-v18.12.1-linux-x64/bin/:/opt/nodejs/node-v18.12.1-linux-x64/bin/:/opt/nodejs/node-v18.12.1-linux-x64/bin/
GDMSESSION=ubuntu
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus ROS_DISTRO=foxy
LC_NUMERIC=zh_CN.UTF-8 OLDPWD=/home/changxianrui/cxr/c++/pointer
_=./a.out

这种kv格式的数据，基本就是环境变量。从进程内存布局空间来看，也可以解释得通。《UNIX环境高级编程》中的内存模型图展示了进程空间最上方的存储是命令行和环境变量。

此技术可以应用在修改进程名称上：先将环境变量等信息拷贝一份，然后全局变量重新指向，最后覆盖这块区域内容为自定义名称。