Memory allocation in

[futSecGuy1990]

im playing with buffer overflows and im not understandning why when i type 1234567890 after ./program_name i dont get an overflow of the last two bytes "90" into buffer_one. buffer_two is located at 0xa0 and buffer_one is located at 0xb0. 0xb0 - 0xa0 = 0x10 = 16 bytes. why is my computer allocating 16 bytes when the array buffer_two and buffer_one is only supposed to have 8 bytes b/w them.also, when i run sizeof(char) i get 1 byte. im running on a 64 bit processor but not sure how this is affecting it. can someone explain in detail or point me to a good source?

int main(int argc, char *argv[])
{
    int value = 5;
    char buffer_one[8], buffer_two[8];

    strcpy(buffer_one, "one"); /* Put "one" into buffer_one */
    strcpy(buffer_two, "two"); /* Put "two" into buffer_two */

    printf("[BEFORE] buffer_two is at %p and contains \'%s\'\n", buffer_two,    buffer_two);
    printf("[BEFORE] buffer_one is at %p and contains \'%s\'\n", buffer_one,    buffer_one);
    printf("[BEFORE] value is at %p and is %d (0x%08x)\n", &value, value,       value);

    printf("\n{STRCPY] copying %d bytes into buffer_two\n\n", strlen(argv[1]));
    strcpy(buffer_two, argv[1]); /* Copy first arg into buffer */

    printf("[AFTER] buffer_two is at %p and contains \'%s\'\n", buffer_two,     buffer_two);
    printf("[AFTER] buffer_one is at %p and contains \'%s\'\n", buffer_one,     buffer_one);
    printf("[AFTER] value is at %p and is %d (0x%08x)\n", &value, value, value);
}// END OF MAIN

[futSecGuy1990]

btw, i have also changed the bytes size from 8 to 4 to 1. but they all = a 16 byte spacing between the two mem address......?? ??

[weaknessforcats]

You are making assumptions about how the compiler manages memory.

It is true that buffer_one starts at address X and buffer_two starts at address Y.

But it does not follow that Y-X gives the memory allocated to buffer_one?

What usually happens is that buffer_one is aligned with a word boundary if possible. Next, sizeof(buffer_o ne)/sizeof(char) is 8. So the array is 8 char. The compiler sees it as 8 char and if you go beyond 8 you enter the world of indeterminate results. The same can be said by proceeding to the left of the array rather than to the right.

Your stack variables are not jammed together like a tiled floor. Many are aligned on word or int boundaries creating any number of slack bytes.

When you enter 10 char into an array of 8 there may, or may not, be a crash. Another variable may, or may not, have been trodden on. All you can say is that the stack is now corrupt. This may lead to a crash later.

Take a heap allocation:

int* buffer_three = new int[8];

buffer_three is the address of the 8 int heap array. Then when you code:

delete buffer_three;

How does the compiler know buffer_three points to 8 bytes and not 8000? How much memory does the compiler free up? buffer_three just has the address of the array. The answer here is that the new operator pre-pends a header before buffer_three that contains the allocation info. Like the fact that there are 8 bytes and whether the array has been deleted already. However, since this pre-pended header is a compiler implementation trick, no info about it appears in any C++ book since the header is not part of the C++ language.

I hope this helps a little.

[futSecGuy1990]

So I'm writing into the slack bits? I soppose I should read up on how memory is allocated during compilation. Would wiki be a good source or do you know of a better site?

[computerfox]

Here's a good starting point:

http://www.cprogramming.com/tutorial/c++_memory_problems.html

Also, if you plan on being serious with C++, I would suggest starting to build a library of REFERENCE books.

Hope that helps!

[weaknessforcats]

Memory allocation is compiler dependent. I would research how the compiler I am using does it. But be careful. If you program based on a specific compiler, your code will be unportable.