Consider the following C Program:

#include #include

#define SECRET1 0x44 // Note that 0x44 is equivalent to ASCII D #define SECRET2 0x55 // Note that 0x55 is equivalent to ASCII U

int main(int argc, char *argv[]) { char user_input[100]; int *secret; int int_input;

/* the secret values will be stored on the heap */ secret = (int *) malloc(2 * sizeof(int));

/* set the secret values to some constants */ secret[0] = SECRET1; secret[1] = SECRET2;

/* print some memory addresses to help understand the attack */ printf("user_input's address is 0x%08x (on stack) ", (unsigned int) user_input); printf("int_input's address is 0x%08x (on stack) ", (unsigned int) &int_input); printf("The variable secret's address is 0x%08x (on stack) ", (unsigned int) &secret); printf("The variable secret's value is 0x%08x (on heap) ", (unsigned int) secret); printf("secret[0]'s address is 0x%08x (on heap) ", (unsigned int) &secret[0]); printf("secret[1]'s address is 0x%08x (on heap) ", (unsigned int) &secret[1]);

printf("Please enter a string "); gets(user_input); printf("Please enter a decimal integer "); scanf("%d", &int_input);

/* here's the printf string format vulnerability */ printf(user_input); printf(" ");

/* check whether your overwriting attack in Section 2.4 worked */ printf("Original secrets: 0x%02x, 0x%02x ", SECRET1, SECRET2); printf("New secrets: 0x%02x, 0x%02x ", secret[0], secret[1]);

return 0; }

When ran on a SEED Linux Virtual Machine, and entering the string abc during the string prompt and entering the number 22 for the number prompt, we get the following info:

user_input's address is 0xbffff328 (on stack)

int_input's address is 0xbffff324 (on stack)

The variable secret's address is 0xbffff320 (on stack)

The variable secret's value is 0x0804b008 (on heap)

secret[0]'s address is 0x0804b008 (on heap)

secret[1]'s address is 0x0804b00c (on heap)

Please enter a string: abc

Plase enter a decimal integer: 22

Original secrets: 0x44, 0x55

New secrets: 0x44, 0x55

Question: Draw a picture showing the stack and the heap. For both the stack and the heap your picture should show (a) the memory addresses of each item in the stack/heap (b) the name of the C variable for that item and (c) the value in that memory.