Hi. > Yes. You need to return from the current function for the return address > to be used. Hum, sorry I don't understand you completely. Could you show me how the stack looks like in the example with the exit-call? In a 'normal' case it would look like this: [100 byte buf][4 byte EBP][4 byte EIP] If you now start the program with more than 108 chars as argument it should exit with "Segmentation fault [...] in address 0x41414141", shouldn't it? But I can't see why it sould behave in another way when exit is used... :-/ thx&bye Tom ------------------------------------------------------------------------ To unsubscribe email security-discuss-request@linuxsecurity.com with "unsubscribe" in the subject of the message.