I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the second buffer to 1. There are a couple of solutions for this challenge that I do not understand. Please, consider the following:
- python3 -c "print('A' * 32 + '\x00' * 4)" | ./simple_overflow
- python3 -c "print('A' * 31 + '\n')" | ./simple_overflow
- perl -e "print \"A\" x 32 . \"\0\"" | ./simple_overflow
- head -c 33 /dev/zero > input && ./simple_overflow < input
The first solution is straight forward. It writes 32 bytes into the first buffer and then four null bytes into the second one. Writing 4 bytes makes sense since integers are 4 bytes in size. However, the second answer only writes 31 bytes plus '\n', and the third and fourth solutions use 33 bytes. The three of them work correctly (see screenshot).
If you need to check the asm associated with this binary please see here.
Why do solutions 2 to 4 work? Are \n and \0 internally considered integers? What about \x00?
Note: solutions provided by users nicknamed h0un6, bottonim and escalatedquickly.