Integer Overflow in C [closed] - c

Question

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.
Closed 10 years ago.
I have this piece of code that I need to modify to demonstrate integer overflow vulnerability. I have never done it before and need a head start.
#include <stdio.h>
int myprintf(char* argv){
printf("%s\n", argv);
return 0;
}
int myprintf2(char* argv){
printf("hello world\n");
return 0;
}
int main(int argc, char** argv){
struct foodata{
int (*fptr)(char*);
int buf[4];
} foo;
foo.buf[0] = 0xdeadbeef;
foo.fptr = myprintf;
foo.buf[0xffffffff] = myprintf2;
foo.fptr(argv[1]);
return 0;
}

Answer 1

Ok. So your code, at least on some 32-bit platforms, does print hello world\n and not the argument from the user. We have changed the function pointer by manipulating other array. Now we want to use it for malicious purpose.
First thing - we replace myprintf2 with something dangerous, when called without some checking, like:
void set_authorized(void) {
authorized = 1;
}
Now, we need to have to get some input from user. For example we will read four numbers and use their sum as index to buf, when the input seems valid.
int a, b, c, d;
do {
scanf("%d%d%d%d", &a, &b, &c, &d);
} while (a < 0 || b < 0 || c < 0 || a + b + c > 4);
buf[a+b+c] = d;
Looks like we could never write outside the array, right?
No, the attacker can use data
a = INT_MAX;
b = 1;
c = INT_MAX;
d = (int)set_authorized
INT_MAX + 1 + INT_MAX = INT_MIN + INT_MAX = -1 (0xffffffff). So we basically have behavior like in your example, but this time it grants unprivileged user some rights.
Note:
To have this example working on 64-bit platform replace int buf[4]; with long buf[4] and 0xffffffff with 0xffffffffffffffff.