Difference in binary behaviour (execution/under debugger)

Question

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in x86/x64 to understand it better. This is the code I used

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[])
{
    char *name = malloc(0x6);
    char *command = malloc(0x6);
    strcpy(command,"whoami");
    strcpy(name,"zzzzzzzzzzzzzzzzls -l");

    system(command);
}

I noticed that if I compiled the code and ran it normally, I will get system to execute "ls -l" and does a folder listing. However, if I was stepping through the binary using lldb from start to midway and proceed to continue the rest of the execution while inside lldb, I will see "whoami" executed instead.

I am testing this on a Mac OS and I am not sure if this is due to lldb or Mac OS behaviour?

Answer 1

For the overflow from name to command to work, the difference between the addresses of both should be 0x10 bytes.

I verified what I mentioned in the case earlier - Adding

printf("%p:%p\n", name, command);

Under a debugger stepping through main gives the addresses as

0x100404080:0x1002059f0

Here delta > 0x10 bytes and hence the name strcpy would not overflow to command

while without stepping or without a debugger comes out

0x7fa890405830:0x7fa890405840

exactly 0x10 bytes.