Buffer overflow this and run multiplication instead of addition? - c

Question

#include <stdio.h>
int num1;
int num2;
int res;
static int add(void) {
res = num1 + num2;
printf("\nAnswer: %u", res);
}
static int sub(void) {
res = num1 - num2;
printf("\nAnswer: %u", res);
}
static int mal(void) {
res = num1 * num2;
printf("\nAnswer: %u", res);
}
static int div(void) {
res = num1 / num2;
printf("\nAnswer: %u", res);
}
void do_operator() {
char op[1];
printf("Enter an operator (+, -, *, /):");
scanf("%s", &op);
if (*op == '+')
{
add();
}
else if (*op == '*')
{
mal();
}
else if (*op == '-')
{
sub();
}
else if (*op == '/')
{
div();
}
else
{
printf("\nNo valid input: %s", op);
}
}
int main() {
printf("\nEnter number-1:");
scanf("%u", &num1);
printf("\nEnter number-2:");
scanf("%u", &num2);
do_operator();
return 0;
}
Hey, I’m new to buffer overflow exploits. I’m trying to run this code and when giving input instead of the addition function running + run the multiplication function \* using buffer overflow. I have tried multiple different but non prevailed
Buffer overflow exploit the give code to execute multiplication function \* but the operator given is addition function +

Answer 1

The code has undefined behavior for multiple reasons:
you do not test the return values of scanf(), so invalid input will not be detected.
the functions add, sub, mal, div are defined to return an int value but the code does not have return statements.
you pass a 1 byte array for %s which will cause a buffer overflow unless at end of file. Furthermore, &op does not have the expected type for %s. A more reliable way to input the operation is
if (scanf(" %c", op) == 1) {
/* operation was read as a single character */
} else {
/* unexpected end of file or input error */
}
It is very difficult to exploit these flaws to make the code call mal() instead of add(), but here is an example where invalid input will appear to use multiplication instead of addition:
Enter number-1:0+ 1
Enter number-2:Enter an operator (+, -, *, /):
Answer: 0