Hi.

> In the last lecture, it was said that "“buf” is a local variable, that’s in the current stack frame. The other variables in this code are local variables. Those variables are overwritten, then the return address is overwritten, and then the memory location to go to once the function has finished is overwritten. Parameters are then passed to the function. This is how the stack could be exploited". It was in regards to the following code:
>
> #define BUFSIZE 512
> ...
> char buf[BUFSIZE];
> printf("Please enter your name \n");
> gets(buf);

> Could you further explain this?

Can you clarify exactly what it is you don't understand? Otherwise it's difficult for me to know what needs explaining. (In future, it would also be helpful if you gave the exact slide number you're referring to.)

However, I do note that you've quoted slide 72 of lecture 2 incorrectly. The slide does not say:

The other variables in this code are local variables. Those variables are overwritten, then the return address is overwritten, and then the memory location to go to once the function has finished is overwritten. Parameters are then passed to the function. This is how the stack could be exploited

It says something different, namely:

text version:

So what will be sitting in memory after buf?

buf here is a local variable, sitting in the current stack frame. After it come other local variables, so those will get overwritten; and then the return address, the location in memory to go to once the current function has finished; and then the parameters passed to the current function.

Specifically, note that the slide does not say "parameters are passed"; it says that the parameters that were passed are overwritten.

Refer to slide 49 of the same lecture for details of the structure of a stack frame. The slide shows that the stack frame contains

• local variables for a function
• an address to return to
• parameters passed to the function

and these are exactly the things that slide 72 says are overwritten.

Do you know, in general terms, how a CPU works (the 'fetch-execute' cycle) and how the OS manages processes (e.g. storing the current instruction pointer for a process, pushing and popping stack frames)? If the lecture slide explanation of stack frames is not clear, I'd suggest reviewing your operating systems textbook and what it says about those two topics. Without knowing what textbook you're using, I can't say exactly where they would be discussed; however

• In Arpaci-Dusseau et al, Operating Systems: Three Easy Pieces, they're discussed in section 4, "Processes".
• In Wienand, Computer Science from the Bottom Up, it's discussed in section 3.1 "The CPU" and section 5.2 "Elements of a process".

For stack-based buffer overflow attacks specifically, you might find helpful the discussion of stack-based buffer overflows contained in section 2.3, "String Vulnerabilities and Exploits", of Seacord, Secure Coding in C and C++.

I hope that helps. If you've worked through the readings and things are still not clear, feel free to post back and say exactly which parts you had trouble with.

Cheers,

Arran