Search code examples
c++arraysmemorybuffer-overflowexploit

Overwriting data via array vulnerabilities

I am trying to demonstrate a buffer overflow via an array index (when there isn't any bounds checking). What I am trying to do is change my bool authenticated = false to true by passing in a bad value.
I am using GCC 4.8.5

arrayVulnerability(int size)
{
   int array[4];
   bool authenticated = false;

   for (int i = 0; i < size; i++)
   {
      array[i] = size;
   }
}

My understanding is that my memory is set up as follows: enter image description here

I was hoping that by passing an int larger than 4 I would be able to overwrite that position to true but it's not working. I'm curious if I have my memory misunderstood or if I am missing something?

Edit: I printed out the locations as suggested and got the following:

bool authenticated = 0x7ffc4741612f
array[0] = 0x7ffc47416130
array[1] = 0x7ffc47416134
array[2] = 0x7ffc47416138
array[3] = 0x7ffc4741613c
array[4] = 0x7ffc47416140

So it looks like bool authenticated is before my array and my memory layout was wrong. I'm still confused about why it is before my array however.

Solution

  • The most likely implementation of automatic storage, the stack, grows downwards as objects are allocated. This means that array is allocated a certain address, and then authenticated is allocated a lower address. You can do some quick experiments to verify if this is the case. Either look at the state of an object defined before array, or print the addresses of the objects.