Hands-On System Programming with Linux

Test case 5

Read overflow, on compile-time allocated memory. We attempt a read on a compile-time allocated memory buffer, after its last legally accessible location:

/* test case 5 : out-of-bounds : read overflow [on compile-time memory] */static void read_overflow_compilemem(void){    char arr[5], tmp[8];    memset(arr, 'a', 5);    memset(tmp, 't', 8);    tmp[7] = '\0';    printf("arr = %s\n", arr); /* Bug: read buffer overflow */}

The way this test case is designed, we have two buffers arranged sequentially in memory. The bug: we deliberately do not null-terminate the first buffer (but do so on the second one), so, the printf(3) that will emit on arr continues reading into the second buffer, tmp. What if the tmp buffer contains secrets?

The point, of ...