Vulnerability Development: Re: argc issue

[jlongs2 () uic edu]

On Tue, 23 May 2006, padre () correo ugr es wrote:

> int main (int argc, char **argv)
> {
> char *a;
> char *b;
>
> a=malloc(char *)(100);
> b=malloc(char *)(100);
>
> if (argc)
>    exit (-1);
> else {
>      strcpy(a,argv[1]);
>      }
>
> free (a);
>
> return 0;
> }
You're going to have to execve(2) that program from another program, in 
order to control its argv/argc.
printargc.c:
int main(int argc, char **argv)
{
    printf("%d\n",argc);
}

execargc.c:
int main()
{
    char *av = 0;
    execve("./printargc",&av,0);
}

$ ./printargc
1
$ ./execargc
0

This doesn't leave you much of anywhere though, because you can't fill 
that buffer...