Can you give an example of a buffer overflow?

Question

I've heard so much about buffer overflows and believe I understand the problem but I still don't see an example of say ``` char buffer[16]; //code that will over write that buffer and launch notepad.exe ```

Accepted Answer

First, you need a program that will launch other programs. A program that executes OS `exec` in some form or other. This is highly OS and language-specific.

Second, your program that launches other programs must read from some external source into a buffer.

Third, you must then examine the running program -- as layed out in memory by the compiler -- to see how the input buffer and the other variables used for step 1 (launching other programs) exist.

Fourth, you must concoct an input that will actually overrun the buffer and set the other variables.

So. Part 1 and 2 is a program that looks something like this in C.

```
#include <someOSstuff>
char buffer[16];
char *program_to_run= "something.exe";
void main( char *args[] ) {
    gets( buffer );
    exec( program_to_run );
}
```

Part 3 requires some analysis of what the `buffer` and the `program_to_run` look like, but you'll find that it's probably just

```
 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 \x00 s o m e t h i n g . e x e \x00
```

Part 4, your input, then has to be

```
1234567890123456notepad.exe\x00
```

So it will fill `buffer` and write over `program_to_run`.

Can you give an example of a buffer overflow?

Solution

Problem