/* BufferOverflow2.c * Author: Dean F. Hougen * Copyright: 2003, all rights reserved. * * This program shows buffer overflows caused by gets(). In this program, * a buffer overflow can be used to compromise the safety of any of the * user's files. */ #include #include int main (void){ fcn(); } int fcn (void){ char pager[5]; char filename1[20]; char filename2[20]; char filename3[20]; char filename4[20]; char filename5[20]; int choice = -1; while ('0' != choice && '1' != choice){ printf("Please enter 1 to use 'more' or 0 to use 'less' "); choice = getchar(); if (EOF == choice){ perror("Error with getchar:"); exit(1); } getchar(); // read the return } if ('0' == choice) strcpy(pager, "less"); else // choice must be 1 strcpy(pager, "more"); printf("Please enter the first file name: "); if (NULL == gets(filename1)){ perror("Error with gets:"); exit(1); } printf("Please enter the second file name: "); if (NULL == gets(filename2)){ perror("Error with gets:"); exit(1); } printf("Please enter the third file name: "); if (NULL == gets(filename3)){ perror("Error with gets:"); exit(1); } printf("Please enter the fourth file name: "); if (NULL == gets(filename4)){ perror("Error with gets:"); exit(1); } printf("Please enter the fifth file name: "); if (NULL == gets(filename5)){ perror("Error with gets:"); exit(1); } execlp(pager, pager, filename1, filename2, filename3, filename4, filename5, NULL); perror("Error with execlp"); // CANNOT GET HERE EXCEPT ON ERROR exit(1); }