缓冲区溢出

Question

I have been searching online for a few days but still cannot figure out what is the vulnerability for below code. My first thought is that we can do overflow for int 'length' and then do buffer overflow exploit to copy shell code and return address to buffer. However the 'length' size in the code is preventing a buffer overflow. Can anyone shed some lights on how to exploit this program? thanks much!

void copy_str(char *buffer2, int buffer2_l, char *input)
{
   int i, length;

   length = strlen(input);
   if (length > buffer2_l)
     length = buffer2_l;

   for (i = 0; i <= **length**; i++)
       buffer2[i] = input[i];
}

void vul2(char *arg)
{
  char buffer[109];

  copy_str(buffer, sizeof buffer, arg);
 }

void vul1(char *argv[])
{
   vul2(argv[1]);
}
int main(int argc, char *argv[])
{
  if (argc != 2)
    {
      fprintf(stderr, "program2: argc != 2\n");
      exit(EXIT_FAILURE);
    }
  vul1(argv);
  return 0;
}

Answer 1

如果argv[1]为109个字符或更长，则将buffer溢出1个char ，因为您使用<=进行长度比较。