在C中导致缓冲区溢出以强制为真条件

Question

I'm trying to solve this challenge where the goal is to get the program to display "YOU WIN!" To do this I must find the right values ​​of the variables to make both the if condition and assert evaluate to true.

Originally I thought this would be relatively simple. However, it seems that to make a buffer overflow is an art that requires advanced programming skills (big-endian and little-endian concepts too), but I do not have much experience in C programming.

Any help or advice would be greatly appreciated.

#include<assert.h>
int
main(int argc, char*argv[]){
    int size = 0;
    int buf[1024];
    read(0,&size,sizeof(size));
    assert (size <= 1024);
    read(0,buf,size*sizeof(int));
    if (size > 0 && size < 100 && buf[999] == 'B')
        printf("YOU WIN!\n");
    return 0;
}

Answer 1

Fun problem.

You have to know something about the machine you're running on, so I made the following assumptions:

1. 32-bit machine, big endian.

2. Compiler does "classical" stack layout, which would put size adjacent to the end of buf .

3. Data is aligned to 4 bytes or less so there is no padding between the end of buf and size .

The classic compiler on this machine allocates your variables on the call stack in the order they appear in the code, so size gets pushed first, and then buf . Your stack will look like this:

                   buf                byte
   top of stack   offset             offset
   +-----------+    0 * sizeof(int) =    0  
   | buf[   0] |   
   +-----------+    1 * sizeof(int) =    4
   |           |   
   ...
   |           |
   +-----------+ 1023 * sizeof(int) = 4092
   | buf[1023] |
   +-----------+ 1024 * sizeof(int) = 4096
   |   size    |
   +-----------+ 1025 * sizeof(int) = 4100
  bottom of stack

Writing to buf[1024] would overwrite size . If we were writing raw bytes, then byte 4096, 4097, 4098, and 4099 would correspond to the bytes in size .

We know we want size to be negative to pass the assert , and we want size * sizeof(int) to evaluate to 4100. Because if we read 4100 bytes, the last 4 bytes will overwrite size .

size * 4 = 4100.  Solving for size:
size = 1025 (or 0x401)

Now we just make it negative by setting the most significant bit.

0x80000401

So setting size to this value will pass assert (size <= 1024) . Because anything with the most significant bit set is negative, and all negative numbers are less than 1024.

When we get to the buffer read, it will get evaluated like so:

read(0, buf, 0x80000401 * sizeof(int));
read(0, buf, 0x80000401 * 4);
read(0, buf, 0x00001004) == read(0, buf, 4100)

Yes, that's right, we just told it to read 4100 bytes because of 32-bit modulo arithmetic. Or if it helps, you can think of multiplying by 4 as shifting left by 2, so shifting our magic value left by 2 gets rid of the most-significant bit.

To print "YOU WIN!", you'd write a stream of bytes, where buf[999] is byte 3996 and bytes 4096, 4097, 4098, and 4099 are the bytes of size . On this hypothetical big-endian machine, we'd set those bytes to 0, 0, 0, and 1-99, respectively.