Search code examples
cgccc-stringsbuffer-overflowgets

How to input a string to C with null character in it via gets?


I am trying to demonstrate a buffer overflow, and I wish to overwrite a local varible with gets. I have compiled my program using gcc with -fno-stack-protector, so I know that the buffer that gets uses is right next to another local variable I am trying to overwrite. My goal is to overflow the buffer and overwrite the adjacent variable so that both of them have the same string. However, I noticed that I need to be able to input the '\0' character so that strcmp will actually show that both are equal. How can I input '\0'?


Solution

  • On many keyboards, you can enter a NUL character with ctrl@ (might be ctrlshift2 or ctrlalt2).

    Barring that, you can create a file with a NUL byte and redirect that as stdin.