/* width1.c – exploiting a trivial widthness bug */
/*
* Consider executing with
* ./width1 5 hello
s = 5
hello
./width1 80 hello
Oh no you don’t!
./width1 65536 hello
s = 0
Segmentation fault (core dumped)
*/
#include
#include
int main(int argc, char *argv[]){
unsigned short s;
int i;
char buf[80];
if(argc < 3){
return -1;
}
i = atoi(argv[1]);
s = i;
printf("0x%08x\n",i);
printf("0x%04x\n",s);
if(s >= 80){ /* [w1] */
printf(“Oh no you don’t!\n”);
return -1;
}
printf(“s = %d\n”, s);
memcpy(buf, argv[2], i);
buf[i] = ‘\0’;
printf(“%s\n”, buf);
return 0;
}