EXPLOITATION - Hacking: The Art of Exploitation - page 119

0x320 Buffer Overflows

Buffer overflow vulnerabilities have been around since the early days of com-
puters and still exist today. Most Internet worms use buffer overflow vulner-
abilities to propagate, and even the most recent zero-day VML vulnerability
in Internet Explorer is due to a buffer overflow.
C is a high-level programming language, but it assumes that the
programmer is responsible for data integrity. If this responsibility were
shifted over to the compiler, the resulting binaries would be significantly
slower, due to integrity checks on every variable. Also, this would remove a
significant level of control from the programmer and complicate the
language.
While C's simplicity increases the programmer's control and the efficiency
of the resulting programs, it can also result in programs that are vulnerable
to buffer overflows and memory leaks if the programmer isn't careful. This
means that once a variable is allocated memory, there are no built-in safe-
guards to ensure that the contents of a variable fit into the allocated memory
space. If a programmer wants to put ten bytes of data into a buffer that had
only been allocated eight bytes of space, that type of action is allowed, even
though it will most likely cause the program to crash. This is known as a
buffer overrun or buffer overflow , since the extra two bytes of data will overflow
and spill out of the allocated memory, overwriting whatever happens to
come next. If a critical piece of data is overwritten, the program will crash.
The overflow_example.c code offers an example.

overflow_example.c

#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[]) {
int value = 5;
char buffer_one[8], buffer_two[8];

strcpy(buffer_one, "one"); /* Put "one" into buffer_one. */
strcpy(buffer_two, "two"); /* Put "two" into buffer_two. */

printf("[BEFORE] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[BEFORE] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[BEFORE] value is at %p and is %d (0x%08x)\n", &value, value, value);

printf("\n[STRCPY] copying %d bytes into buffer_two\n\n", strlen(argv[1]));
strcpy(buffer_two, argv[1]); /* Copy first argument into buffer_two. */

printf("[AFTER] buffer_two is at %p and contains \'%s\'\n", buffer_two, buffer_two);
printf("[AFTER] buffer_one is at %p and contains \'%s\'\n", buffer_one, buffer_one);
printf("[AFTER] value is at %p and is %d (0x%08x)\n", &value, value, value);
}