The following C code has a vulnerability:

/* requires: len == size(in) */

void vuln(uint64_t in[], size_t len) {

char a[20];

size_t i;

for (i=0; i

memcpy(&(a[i]), &(in[i]), sizeof(uint64_t));

}

}

Assume that the elements and length of in are controlled by the attacker, but it is guaranteed that vuln() will be called with arguments where len is equal to the number of elements in in(i.e., assume that the precondition of vuln() always holds).

vuln() is vulnerable to a buffer overflow attack. Explain why, and given an example value of len that would enable such an attack