gcc 编译器是否总是将整数放在内存中的字符数组之前？答案

【问题标题】：Are integers always placed before character array in memory by the gcc compiler?gcc 编译器是否总是将整数放在内存中的字符数组之前？
【发布时间】：2020-04-23 09:18:06
【问题描述】：

我正在尝试 HTAOE book 中的 C 语言中的简单缓冲区溢出。这是代码：

#include<stdio.h>
#include<string.h>

int main(int argc, char *argv[]){
        int val0=10;
        char buffer_two[8], buffer_one[8];
        int val1=5;

        strcpy(buffer_one, "one");
        strcpy(buffer_two, "two");
        printf("[BEFORE] buffer_two is at @%p contains \'%s\'\n", buffer_two, buffer_two);
        printf("[BEFORE] buffer_one is at @%p contains \'%s\'\n", buffer_one, buffer_one);
        printf("[BEFORE] val1 is @%p and contains \'%d\' [0x%08x]\n", &val1, val1, val1);
        printf("[BEFORE] val0 is @%p and contains \'%d\' [0x%08x]\n", &val0, val0, val0);

        printf("Copying the argv[1], which is %ld bytes, into buffer_two..\n", strlen(argv[1]));
        strcpy(buffer_two, argv[1]);

        printf("[AFTER] buffer_two is at @%p contains \'%s\'\n", buffer_two, buffer_two);
        printf("[AFTER] val1 is @%p and contains \'%d\' [0x%08x]\n", &val1, val1, val1);
        printf("[AFTER] val0 is @%p and contains \'%d\' [0x%08x]\n", &val0, val0, val0);
        return 0;

}

在正常编译后（没有额外的标志），我使用

运行它（缓冲区溢出）

./overflow_example "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

其中“AA.....”是第一个参数，A 的数量超过 16 个。正如预期的那样，溢出发生在 buffer_one。但我期望整数val0 或val1 也会发生溢出。失败。我注意到整数放在堆栈中的字符数组之前，为什么？所以那里没有发生溢出。输出：

[BEFORE] buffer_two is at @0x7fffa43fa1a8 contains 'two'
[BEFORE] buffer_one is at @0x7fffa43fa1b0 contains 'one'
[BEFORE] val1 is @0x7fffa43fa1a4 and contains '5' [0x00000005]
[BEFORE] val0 is @0x7fffa43fa1a0 and contains '10' [0x0000000a]
Copying the argv[1], which is 45 bytes, into buffer_two..
[AFTER] buffer_two is at @0x7fffa43fa1a8 contains 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
[AFTER] buffer_one is at @0x7fffa43fa1b0 contains 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
[AFTER] val1 is @0x7fffa43fa1a4 and contains '5' [0x00000005]
[AFTER] val0 is @0x7fffa43fa1a0 and contains '10' [0x0000000a]
*** stack smashing detected ***: <unknown> terminated
Aborted (core dumped)

我的问题是如何指示编译器不要将整数放在字符数组之前，而是将它们放在堆栈中的字符数组之后，这样可能会发生溢出。我期待不可能吗？有可能这样做吗？或者它是微不足道的，比如用 gcc 命令提供一个标志？

请帮忙。

PS：Ubuntu X86-64机器的运行

【问题讨论】：

您知道堆栈在 x86_64 上会向后增长吗？

标签： c arrays gcc memory buffer-overflow

【解决方案1】：

您要求以一种明智的方式帮助您调用未定义的行为，这通常会让您投反对票，因为 Stack Overflow 是为了编写好的软件，而不是故意可利用的软件。

也就是说，您可以尝试将相关变量放入结构中：

int main(int argc, char *argv[]){
    struct {
        int val0;
        char buffer_two[8];
        char buffer_one[8];
        int val1;
    } group = {
        .val0 = 10,
        .val1 = 5,
    };


    strcpy(group.buffer_one, "one");
    strcpy(group.buffer_two, "two");

    // ...
}

【讨论】：