Trigger and Diagnose a Stack Buffer Overflow

Topic Overview

Stack Buffer Overflow Basics

A stack buffer overflow occurs when a program writes more data into a stack-allocated buffer than it was designed to hold. The excess bytes overwrite adjacent memory, including the saved frame pointer and return address, potentially hijacking execution.

Stack Layout and Overflow Mechanics

On x86-64, the stack grows downward with this layout (high to low addresses):

• Function arguments
• Return address
• Saved frame pointer (RBP)
• Local variables (including buffers)

When strcpy(buf, input) writes past a char buf[16], the overflow corrupts RBP first, then the return address. On function return, the CPU jumps to the attacker-controlled address.

Vulnerable functions include gets(), strcpy(), strcat(), and sprintf() because they perform no bounds checking.

For This Exercise

You will compute, for a given stack frame and write length, exactly which stack regions a write reaches: the offset from the buffer start to the return address, whether the saved frame pointer and return address are corrupted, and the exact payload layout. Understanding this arithmetic is the foundation for every stack-based exploitation technique in the rest of this subtrack.

Visualizing the Overflow

Draw the stack from high to low addresses: return address at the top, saved RBP below it, then your buffer. A 24-byte write into a 16-byte buffer overwrites 8 bytes of saved RBP and 8 bytes of return address on x86-64. Defensive coding replaces strcpy with strncpy or snprintf, and compilers emit stack canaries when you build with -fstack-protector. Legacy codebases still contain unchecked copies.

Write a C program that reads three integers from stdin (the local buffer size, the saved frame pointer size, and the length of an unchecked write) and computes which parts of the stack frame the write corrupts.

Requirements:

• Compute the offset to the return address: buffer size + saved frame pointer size
• Compare the write length against that offset
• Print one of three verdicts: SAFE (with bytes-short count), SAFE (write ends exactly at the boundary), PARTIALLY OVERWRITTEN (k of 8 return-address bytes), or FULLY OVERWRITTEN
• When the return address is touched, print the payload layout: which byte ranges fill the buffer, overwrite the saved frame pointer, and overwrite the return address

Success Criteria:

• Offset is computed from the inputs, not hardcoded
• The partial-overwrite boundary (fewer than 8 bytes reaching RIP) is handled correctly
• The payload layout byte ranges match the computed offsets