I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the "call exit" instruction at 0x08048954.
Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?
For reference, the surrounding code is:
0x080489F1:
push offset aDonTGiveUp ; "Don't give up !"
call puts
add esp, 4
push 0
call exit
push offset aInvalidChoice ; "Invalid choice"
call puts
add esp, 4
nop
Thank you for taking the time to read this.
