Given that function:
void vuln( char * arg ) {
char buf[256];
strcpy(buf, arg);
}
Disassembled in:
0x0804842b 55 push ebp
0x0804842c 89e5 mov ebp, esp
0x0804842e 81ec08010000 sub esp, 0x108
0x08048434 83ec08 sub esp, 8
0x08048437 ff7508 push dword [arg_8h]
0x0804843a 8d85f8feffff lea eax, ebp - 0x108
0x08048440 50 push eax
0x08048441 e8bafeffff call sym.imp.strcpy
0x08048446 83c410 add esp, 0x10
0x08048449 c9 leave
0x0804844a c3 ret
It overflows when the argument is 264 = 0x108 chars and I was expecting 256 bytes. Why compiler adds 8 bytes with sub esp,8
?