CSE 127 Lecture 4: L4 10/9/18
11 Oct 2018
School
Department
Course
Professor
Document Summary
Ebp+8: positive numbers away from the bp are for arguments (previous frame) Ebp-4: negative numbers away from the bp are for your local variables. Format string vulnerabilities printf() - this is not part of the c language! (actually just a byproduct of printf()!) Variadic functions - you can accept a variable # of args! Another arg implicitly encodes count (ex: the string itself!) Last arg is a reserved terminator value (eg. Pushes pointer to format string onto stack. Uses format string to read args off of stack. Reads one value off stack for each % parameter. Printf runtime is controlled by % parameters. You could have too many or too few args though! User is responsible for enforcing 1-1 mapping between format specifiers and args. Too few: it"ll print whatever is on the stack! Not a good idea to let an attacker feed arbitrary commands to your command interpreter! // print everything in buf as a string.
