Why my threaded winsock server won't crash?

Question

I have implemented a c++ winsock (win 32) with intention of crashing using an strcpy command. The socket itself is instantiated inside a thread. However, when I put the strcpy inside the recv loop, it does not seem to crash.

I know there is nothing wrong with the compiler since writing one with just strcpy crashes, I am thinking it is related to recv since it initiates a block on the process.

Here is the full code below for the sever, the crash I am trying to implement is in the form of strcpy(a, "AAAA..."); in regular circumstances it should crash, but here it does not. I would like to know why.

#define WIN32_LEAN_AND_MEAN
#include<windows.h>
#include<winsock2.h>
#include<stdlib.h>
#include<stdio.h>
#include<ws2tcpip.h>
#include <iostream.h>
#include <conio.h>

#define DEFAULT_PORT "1133"
#define DEFAULT_BUFLEN 512

struct thread_data
{
   int m_id;
   thread_data(int id) : m_id(id){}
};

char a[10];

DWORD WINAPI ServerThread (LPVOID pParam){
WSADATA wsaData;
struct addrinfo *result =NULL;
struct addrinfo hints;
SOCKET ListenSocket = INVALID_SOCKET;


do{
  ZeroMemory(&hints, sizeof(hints));
  hints.ai_family = AF_INET;
  hints.ai_socktype = SOCK_STREAM;
  hints.ai_protocol = IPPROTO_TCP;
  hints.ai_flags = AI_PASSIVE;

  int iResult;
  iResult = WSAStartup(MAKEWORD(2,2), &wsaData);

  iResult = getaddrinfo(NULL,DEFAULT_PORT,&hints, &result);



  if (iResult != 0 ){
     printf("get addrinfo failed with error %d\n", iResult);
     WSACleanup();
     return 1;
  } //end if 

 ListenSocket = socket(result->ai_family, result->ai_socktype, result->ai_protocol);
 if (ListenSocket ==0){
   printf("socket creation failed  with error %d\n", WSAGetLastError());
 }
//bind socket
iResult= bind( ListenSocket , result->ai_addr, (int)result->ai_addrlen);


if(iResult == SOCKET_ERROR){
  printf("bind failed with  error %d\n", WSAGetLastError());
  freeaddrinfo(result);

  closesocket(ListenSocket);
  WSACleanup();
  return 1;

}

printf ("initializing socket\n ");

iResult= listen(ListenSocket,SOMAXCONN);

if (iResult== SOCKET_ERROR){
   printf("listen failed with %d\n",WSAGetLastError());
   closesocket(ListenSocket);
   WSACleanup();
   return 1;
}



SOCKET client ;
sockaddr_in from;
int fromlen=sizeof(from);




char temp[1024];
char temp_to_send[1024];
char temp_to_send_vuln[512];
printf("accepting client request\n");
client=accept(ListenSocket, (struct sockaddr*) &from, &fromlen);
printf("accepted socket\n"); 



iResult =1;
int iSendResult =1;
char c;
//start receiving from client
while(   (iResult = recv(client,temp,1024,0 )) > 0 ){



  c = temp[0];
  temp[iResult] = '\0';
  if(c!=13)
  strcat(temp_to_send,temp);


  //if enter is hit echo sent data to client
  if(c ==13 ){
    printf("sending %s \n",temp_to_send);

    //I WANT TO CRASH THE PGORAM HERE!!          
             strcpy(a,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");  

     strcat(temp_to_send_vuln,temp_to_send);
     strcat(temp_to_send_vuln,"\r\n");
     iSendResult = send(client,temp_to_send,strlen(temp_to_send),0);

    //if user types "exit" the client socket would terminate                   
     if (strcmp(temp_to_send,"exit") ==0){
       printf("exit entered\n");


       closesocket(client);
       WSACleanup();
       break;

     }



     re-initialize variables for next input                            
      temp[0] = '\0';
      temp_to_send[0] = '\0';

    }//end if(ch ==13)


 }//end recv

 printf("termination of socket with error %d and buffer length is ", WSAGetLastError());

 printf("client said %s\n", temp) ;
 if (iResult == SOCKET_ERROR){
    printf("receiving failed with error %d",WSAGetLastError());
 }





 if (iSendResult == SOCKET_ERROR){
   printf("seding failed with error %d", WSAGetLastError());
   closesocket(client);
   WSACleanup();
   exit(1);

 }






} while(1);

closesocket(ListenSocket);

WSACleanup();
printf("program ended\n");

return 0;


}

//the main function that calls the thread
int main(void)
{
   //create thread here
   CreateThread(NULL, 0 ,ServerThread, new thread_data(0), 0,0);

   //terminate program when escape character is hit
   while(_getch()!=27);

   return 0;

}

Answer 1

Your strcpy() call is just trashing a and then whatever else happens to be after it in global memory; it's undefined whether it'll crash or not. If you really want to crash out, just call strcpy( NULL, "whatever" ).