Today I learn about buffer overflows, and I came across many examples of vulnerable programs. I am wondering if there are any reasons for working with such program arguments:
int main(int argc, char *argv[])
{
char argument_buffer[100];
strcpy(argument_buffer, argv[1]);
if(strcmp(argument_buffer, "testArg") == 0)
{
printf("Hello!\n");
}
}
Instead simply:
int main(int argc, char *argv[])
{
if(strcmp(argv[1], "testArg") == 0)
{
printf("Hello!\n");
}
}
Please note that I know about the flaws strcpy, etc. is just an example. My question is , is there a true reason to use temporary buffers to store arguments from argv ? I suppose they aren't, but I'm curious why it is present in overflow examples, but in reality it is never used? Maybe because of a pure theory.
source
share