Re: Avoiding Buffer Overflows

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




Are you invoking it with an argument? 

If you are running it without an argument, referrencing argv[1] is not valid 
since it goes beyond the limit of (argc -1). Remember argv[0] is the program 
name and argc[1] is the first argument. 

It runs ok for me with an argument, exiting with status 1 as expected. 

Am I misunderstanding the question  ?



On Wednesday 09 January 2002 16:08, David Correa wrote:
> On Tue, 8 Jan 2002, Trano wrote:
> > #include <stdio.h>
> >
> > int
> > main(int argc, char **argv)
> > {
> >          char buf[100];
> >          strcpy(buf, argv[1]);
> >          exit(1);
> > }
>
> Hi,
>
> That code produces a "Segmentation fault (core dumped)"
> with gcc version 2.96.
>
> Also this one:

This also should give a SEGV since the parameters to strncpy are in the wrong 
order. buf[] has not been properly terminated with '\0'. Can program args be 
overwritten with strncpy? I'm not sure. 

>
> On Wed, 9 Jan 2002, Kenny Colliander wrote:
> >#include <stdio.h>
> >int main(int argc, char **argv)
> >{
> >         char buf[100+1]; // + NULL
> >         strncpy(argv[1], buf, 100);
> >         exit(1);
> >}
>
> Regards,
>
> David Correa RHCE CCNA
> http://www.linux-tech.com
>
>
>
>
> ------------------------------------------------------------------------
>      To unsubscribe email security-discuss-request@linuxsecurity.com
>          with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
     To unsubscribe email security-discuss-request@linuxsecurity.com
         with "unsubscribe" in the subject of the message.


[Index of Archives]     [Fedora Announce]     [Linux Crypto]     [Kernel]     [Netfilter]     [Bugtraq]     [USB]     [Fedora Security]

  Powered by Linux