pointeroverflow.c

这是内存溢出的代码

#include <stdio.h>
char totaladdr[4];
int pstr[2]={1,2};
main()
{
 int process(int i);
  int display(int i);
 int o1,o2;
 int *o3,*o6,**p;
 char *c1;
 o3=&o1;
 *o3=126;
 o6=(int*)117112778;
 *o6=149;
 c1=(char*)o6;
 *c1=1;
 *(c1+1)=1;
 p=&o3;
 **p=6;
 printf("%ld %ld  %ld %d\n",(long)o3,(long)o6,(long)p,o1);
 printf("process=%ld  %p  %p  %p  %p\n",(long)display,&totaladdr[0],&totaladdr[1],pstr,pstr+1);
 process(2);
 printf("Main");
 getch();
 getchar();
 return 0;
}
int process(int i)
 {
  int display(int);
  char addr[4];
  long offset;
  offset= (long)(&i)- (long)addr;
  printf("i=%ld  addr=%ld  sizeof(int)=%d,offset=%ld",(long)(&i),(long)addr,sizeof(int),offset);
  /*totaladdr[0]=addr[offset-1];
  totaladdr[1]=addr[offset-2];
  totaladdr[2]=addr[offset-3];
  totaladdr[3]=addr[offset-4];

  addr[offset-1]= (((long)display)>>24) & 0xFF;
  addr[offset-2]= (((long)display)>>16) & 0xFF;
  addr[offset-3]= (((long)display)>>8) & 0xFF;
  addr[offset-4]= (((long)display)) & 0xFF;    */
  totaladdr[0]=*((char *)((&i)-1));
  totaladdr[1]=*((char *)((&i)-2));
  totaladdr[2]=*((char *)((&i)-3));
  totaladdr[3]=*((char *)((&i)-4));

  printf("\n %d %d %d %d  \n",*(((char *)(&i)-1)),*(((char *)(&i)-2)),*(((char *)(&i)-3)),*(((char *)(&i)-4)));
  printf("\n %d %d %d %d  \n",addr[offset-1],addr[offset-2],addr[offset-3],addr[offset-4]);
  *(((char *)(&i)-1))= (((long)display)>>24) & 0xFF;
  *(((char *)(&i)-2))= (((long)display)>>16) & 0xFF;
  *(((char *)(&i)-3))= (((long)display)>>8) & 0xFF;
  *(((char *)(&i)-4))= (((long)display)) & 0xFF;
   printf("\n %ld, %d %d %d %d  \n",(long)display,*(((char *)(&i)-1)),*(((char *)(&i)-2)),*(((char *)(&i)-3)),*(((char *)(&i)-4)));
   return 0;
 }
 int display(int i)
 {
  int next(int);
  printf("Success!!!!");
  next(2);
  getchar();
  return 0;
 }

 int next(int i)
 {
  int display(int);
  char addr[4];
  long offset;
  offset= (long)(&i)- (long)addr;
  printf("i=%ld  addr=%ld  sizeof(int)=%d,offset=%ld",(long)(&i),(long)addr,sizeof(int),offset);
  addr[offset-1]=totaladdr[0];
  addr[offset-2]=totaladdr[1];
  addr[offset-3]=totaladdr[2];
  addr[offset-4]=totaladdr[3];
  getchar();
  return 0;
 }