Integer overflow / buffer overflow - c

Question

I am trying to learn binary exploitation. I've tried some basic buffer overflow (with shellcode) with simple codes as the one below (from http://phrack.org/issues/49/14.html.):
/*example.2*/
void function(char *str) {
char buffer[16];
strcpy(buffer,str);
}
void main() {
char large_string[256];
int i;
for( i = 0; i < 255; i++)
large_string[i] = 'A';
function(large_string);
}
I was trying to do the same thing the the following code from http://phrack.org/issues/60/10.html
Example 1:
/* width1.c - exploiting a trivial widthness bug */
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]){
unsigned short s;
int i;
char buf[80];
if(argc < 3){
return -1;
}
i = atoi(argv[1]);
s = i;
if(s >= 80){ /* [w1] */
printf("Oh no you don't!\n");
return -1;
}
printf("s = %d\n", s);
memcpy(buf, argv[2], i);
buf[i] = '\0';
printf("%s\n", buf);
return 0;
}
On the document it said:
The length argument is taken from the command line and held in the integer
i. When this value is transferred into the short integer s, it is
truncated if the value is too great to fit into s (i.e. if the value is
greater than 65535). Because of this, it is possible to bypass the bounds
check at [w1] and overflow the buffer. After this, standard stack smashing
techniques can be used to exploit the process.
To overwrite the return address I tried in GDB:
r 65536 $(python -c 'print "\xAA\xAA\xAA\xAA"*32767') and I got
Program received signal SIGSEGV, Segmentation fault.
0x0804854e in main (argc=<error reading variable: Cannot access memory at address 0xaaaaaaaa>,
argv=<error reading variable: Cannot access memory at address 0xaaaaaaae>)
I tried to do something similar with the example I've found here at :
Hacking Challenge - locating vulnerability in the code
int main(int argc, char **argv) {
char *buffer;
unsigned short buffersize, i, index, length;
if (argc < 2) usage(argv[0]);
length = atoi(argv[1]);
if (length <= 0) {
fprintf(stderr, "bad length\n");
return 1;
}
buffersize = length + 1;
buffer = alloca(buffersize);
memset(buffer, ' ', buffersize);
buffer[buffersize - 1] = 0;
for (i = 2; i < argc; i++) {
if (strlen(argv[i]) < 2) {
fprintf(stderr, "bad command \"%s\"\n", argv[i]);
return 1;
}
index = atoi(argv[i] + 1);
if (index >= length) {
fprintf(stderr, "bad index in command \"%s\"\n", argv[i]);
return 1;
}
buffer[index] = argv[i][0];
}
In GDB I've tried r -1 A10
buffersize = length + 1; --> buffersize = 0x0
buffer = alloca(buffersize); --> (gdb) x/x buffer
0xbffff5c0: 0xbffff7cd
(gdb) x/x 0xbffff7cd
0xbffff7cd: 0x4100312d
memset(buffer, ' ', buffersize);
buffer[buffersize - 1] = 0;
Then I've used A*200, but I cannot find and overwrite the return address. Is there a reference where I can get info on how to perform buffer overflow for this specific example?