forum.lissyara.su

Код: Выделить всё

#define BUF_SIZE 1024

  int main (int argc, char* argv[])

   {

   int ouch;
   char buf[BUF_SIZE];
   ouch = atoi(argv[1]);

       if (ouch < BUF_SIZE ) {

         memcpy (buf, argv[2], ouch);

         }

         else
         printf("wow data!!!\n");

          }

Код: Выделить всё

[root@zingel ~/calloc]# gcc -o calloc calloc.c
calloc.c: In function 'main':
calloc.c:15: warning: incompatible implicit declaration of built-in function 'memcpy'
calloc.c:20: warning: incompatible implicit declaration of built-in function 'printf'
[root@zingel ~/calloc]# ls
calloc          calloc.c        calloc.c~
[root@zingel ~/calloc]# ./calloc
Segmentation fault: 11
[root@zingel ~/calloc]# sysctl -w kern.coredump=1
kern.coredump: 0 -> 1
[root@zingel ~/calloc]# ./calloc
Segmentation fault: 11 (core dumped)
[root@zingel ~/calloc]# gdb -c calloc.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
Core was generated by `calloc'.
Program terminated with signal 11, Segmentation fault.
#0  0x28137b87 in ?? ()
(gdb) i r
eax            0x281627a0       672540576
ecx            0xbfbfeca0       -1077941088
edx            0xbfbfeca0       -1077941088
ebx            0x281637f8       672544760
esp            0xbfbfe810       0xbfbfe810
ebp            0xbfbfe838       0xbfbfe838
esi            0x0      0
edi            0x100    256
eip            0x28137b87       0x28137b87
eflags         0x10282  66178
cs             0x33     51
ss             0x3b     59
ds             0x3b     59
es             0x3b     59
fs             0x3b     59
gs             0x3b     59

Код: Выделить всё

[root@zingel ~/calloc]# uname -a
FreeBSD zingel.dubki.ru 7.0-RELEASE-p2 FreeBSD 7.0-RELEASE-p2 #3: Tue Jul  8 17:48:53 EEST 2008     beastie@zingel.dubki.ru:/usr/obj/usr/src/sys/BEASTIE  i386
[root@zingel ~/calloc]# date
Thu Jul 10 01:46:10 EEST 2008

Код: Выделить всё

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUF_SIZE 1024

int main (int argc, char* argv[]) {
	int ouch;
	char buf[BUF_SIZE];
	ouch = atoi(argv[1]);
	if (ouch < BUF_SIZE ) {
		memcpy (buf, argv[2], ouch);
	}
	else {
		printf("wow data!!!\n");
	}
	return 0;
}

Код: Выделить всё

[max@notebook z]$ uname -a
FreeBSD notebook 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Jul  6 22:51:22 MSD 2008     root@notebook:/usr/obj/usr/src/sys/NOTEBOOK  i386
[max@notebook z]$ gcc -g memz.c -o memz
[max@notebook z]$ ./memz 1000 no_core
[max@notebook z]$ ls -l
total 10
-rwxr-xr-x  1 max  max   6,0K 10 июл 04:53 memz*
-rw-r--r--  1 max  max   284B 10 июл 04:38 memz.c
[max@notebook z]$ ./memz
Segmentation fault: 11 (core dumped)
[max@notebook z]$ ls -l
total 330
-rwxr-xr-x  1 max  max   6,0K 10 июл 04:53 memz*
-rw-r--r--  1 max  max   284B 10 июл 04:38 memz.c
-rw-------  1 max  max   300K 10 июл 04:54 memz.core
[max@notebook z]$

Код: Выделить всё

09	char buf[BUF_SIZE];
10	ouch = atoi(argv[1]); // Segmentation fault: 11 (core dumped)
11	if (ouch < BUF_SIZE ) {

Код: Выделить всё

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUF_SIZE 1024

int main (int argc, char* argv[]) {
	int ouch;
	char buf[BUF_SIZE];
	if (argc<3) {
		puts("ГЫЫЫЫЫ");
		return -1;
	}
	ouch = atoi(argv[1]);
	if (ouch < BUF_SIZE ) {
		memcpy (buf, argv[2], ouch);
	}
	else {
		printf("wow data!!!\n");
	}
	return 0;
}

Код: Выделить всё

[max@notebook z2]$ gcc -g memz.c -o memz
[max@notebook z2]$ ls -l
total 10
-rwxr-xr-x  1 max  max   6,1K 10 июл 05:10 memz*
-rw-r--r--  1 max  max   333B 10 июл 05:09 memz.c
[max@notebook z2]$ ./memz
ГЫЫЫЫЫ
[max@notebook z2]$ ./memz 999 no_fail
[max@notebook z2]$ ./memz 9999 no_fail_forever
wow data!!!
[max@notebook z2]$

Код: Выделить всё

(gdb) r
Starting program: /root/calloc/sploit
(no debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x28137b87 in strtol () from /lib/libc.so.7

Код: Выделить всё

(gdb) i r
eax            0x281627a0       672540576
ecx            0xbfbfec70       -1077941136
edx            0xbfbfec70       -1077941136
ebx            0x281637f8       672544760
esp            0xbfbfe7e0       0xbfbfe7e0
ebp            0xbfbfe808       0xbfbfe808
esi            0x0      0
edi            0x100    256
eip            0x28137b87       0x28137b87
eflags         0x10282  66178
cs             0x33     51
ss             0x3b     59
ds             0x3b     59
es             0x3b     59
fs             0x3b     59
gs             0x1b     27