title: memcpy overflow
body: <p>Is it possible to overwrite the eip in the following condition when I have control over the src and the length parameters?</p>
  
  <p>memcpy(float* dest,float* src, int length)</p>
  
  <p>I guess it should be possible to overwrite the eip(?) but is it possible to overwrite it with something meaningful?</p>
  
  <p>**Sorry for not being clear. By overwriting EIP, I mean overwriting the return pointer which would be used by the EIP register after the function returns, transferring the program execution. </p>