C for Hackers

A stack buffer overflow happens when a program copies more data into a fixed-size local buffer than it can hold. Because C does no bounds checking, the extra bytes run past the buffer into adjacent stack memory, including the saved return address. Overwriting that address lets an attacker change where the program jumps when the function returns.

C gives the programmer direct control of memory with no runtime safety net: no automatic bounds checking, no managed memory, and full trust in the code. That control makes C fast and ideal for low-level software, but it also means a single unchecked copy, like a call to gets, can corrupt memory and create a serious vulnerability.

ret2win is a classic teaching exercise where you overwrite a function's saved return address so that it jumps to a function, often named win, that the program never calls on its own. It demonstrates control-flow hijacking in its simplest form and is practised only against a deliberately vulnerable lab binary you own.

No. A segmentation fault from an oversized input proves you reached and corrupted the return address, but it does not mean you control it. The address is filled with garbage, so the CPU jumps somewhere invalid and the kernel kills the process. Controlling where it points is a separate, later step.

At three levels: write safer code using bounded functions like fgets and snprintf instead of gets; compile with protections such as stack canaries, NX, and PIE; and run on an OS with ASLR. Add code review and fuzzing to catch the unchecked copy before it ships. Modern toolchains enable most of these by default.

Because compilers add alignment padding and may save extra registers between the buffer and the saved return address, so the real offset is often not the buffer size plus eight. Professionals measure the exact distance with a cyclic pattern instead of guessing, which is why assuming an offset is a common beginner mistake.