assemblytutorials icon indicating copy to clipboard operation
assemblytutorials copied to clipboard

Potential overflow when printing line feed - Lesson 7

Open peterchaula opened this issue 4 years ago • 1 comments

sprintLF:
    call    sprint
 
    push    eax         ; push eax onto the stack to preserve it while we use the eax register in this function
    mov     eax, 0Ah    ; move 0Ah into eax - 0Ah is the ascii character for a linefeed
    push    eax         ; push the linefeed onto the stack so we can get the address
    mov     eax, esp    ; move the address of the current stack pointer into eax for sprint
    call    sprint      ; call our sprint function
    pop     eax         ; remove our linefeed character from the stack
    pop     eax         ; restore the original value of eax before our function was called
    ret                 ; return to our program

How does the slen subroutine know when to stop incrementing the length of the line feed on the stack seeing that it does not have a null terminator?

peterchaula avatar Sep 22 '20 20:09 peterchaula

This is sound. We are pushing the whole 32-bit EAX register onto the stack, that is 0x0000000A. Given that we have a little-endian architecture, this corresponds to stack memory contents of 0x0A, 0x00, 0x00, 0x00. In effect, we have one line feed followed by three null terminators. slen will therefore function as intended.

    mov     eax, 0Ah  ; move 0x0000000Ah into eax
    push    eax       ; push 0x0000000Ah onto the stack
                      ; memory equivalent to 0x0A, 0x00, 0x00, 0x00

You can step through the code and view the EAX register and stack using something like edb-debugger.

shampoofactory avatar May 06 '22 18:05 shampoofactory