Buffer上的Bufferoverflow(Bufferoverflow on stack)

 我正在审查C中的安全问题。我无法理解下面的代码如何破坏堆栈， 
 
#include<stdio.h>
#include<stdlib.h>
#include<string.h>

int chk_perm(){
        printf("\n Check Perm \n");
        return 2;
}
int main(int argc,char* argv[]){
        int fg;
        char filename[16];

        if(argc != 2){
                fprintf(stderr,"Usage : %s filename\n",argv[0]);
                exit(1);
        }

        fg = chk_perm();
        strcpy(filename,argv[1]);
        if(fg == 0xdeadbeef){
                //execute as root or deposit million dollars in bank account
        }
        else{
                //execute as a normal user , deduct $10 from an account
        }

        return 0;
}
 
 通过的argv [1]可能会改变fg的值。 它说，如果argv [1]传递的是一个可能导致不良结果的整个二进制文件，则可以将其作为参数与返回地址一起传递，从而发生损坏。 
 
 我无法理解，strcpy如何破坏堆栈check_perm，使得fg的值得到改变。 
 
 我对这个计划的假设， 
 
 当程序开始执行时，它为主函数创建一个堆栈，并将其参数，返回地址，局部变量放到堆栈中。因此int fg将占用堆栈的4个字节（08567500 loc），并且文件名[16]将占用接下来的16个字节（08567504）。 即使文件名溢出超过16个字节，它可能会损坏，如果任何本地变量之后存在。 
 
 那么由于strcpy（filename，argv [1]），fg如何被破坏; 

I was going through the security issues in C. I could not understand the below code of how it corrupts the stack,
 
#include<stdio.h>
#include<stdlib.h>
#include<string.h>

int chk_perm(){
        printf("\n Check Perm \n");
        return 2;
}
int main(int argc,char* argv[]){
        int fg;
        char filename[16];

        if(argc != 2){
                fprintf(stderr,"Usage : %s filename\n",argv[0]);
                exit(1);
        }

        fg = chk_perm();
        strcpy(filename,argv[1]);
        if(fg == 0xdeadbeef){
                //execute as root or deposit million dollars in bank account
        }
        else{
                //execute as a normal user , deduct $10 from an account
        }

        return 0;
}
 
The argv[1] passed may change the value of fg. Its said, that corruption will happen, if argv[1] passed is an entire binary that can cause undesired results can be passed as an argument along with return address.
 
I could not understand , how the strcpy corrupts the stack check_perm such that the value of the fg gets changed.
 
My assumption about the program,
 
When program starts executing, It creates a stack for the main function and put its arguments,return address,local variables onto the stack.So int fg will occupy 4 bytes (08567500 loc)of the stack and filename[16] will occupy next 16 bytes(08567504). Even if the filename is overflowing more than 16 bytes it may corrupt if any local variable was present after it.
 
So how does the fg gets corrupted due to strcpy(filename,argv[1]);

原文：https://stackoverflow.com/questions/18724368