Question

I found some C code on internet as:

int main() {
    int cookie;
    char buf[80];

    printf("buf: %08x cookie: %08x\n", &buf, &cookie);
    gets(buf);

    if (cookie == 0x41424344)
        printf("you win!\n");
}

I tried to run this code but it is giving runtime error. I am not sure why any runtime error is being thrown by the compiler as it is simply creating two variables and checking one condition of cookie value equality.

As per some answers stating that cookie variable is not initialized, that’s why I am getting this error, so i modified the code as:

int main() {
    int cookie;
    char buf[80];

    printf("buf: %08x cookie: %08x\n", &buf, &cookie);
    gets(buf);

    if (cookie == 1)
        printf("you win!\n");
}

And guess what this time it din’t give me any runtime error.

Source: http://community.coresecurity.com/~gera/InsecureProgramming/stack1.html

Thanks in Advance

Answer 1

The code is fine. Many compilers “protect” you from the use of uninitialized variables, buffer overflows and such by throwing a runtime error. You can often turn this off through compiler flags.