title: C Buffer Overflow - how many bytes to input
body: <p>I made a simple C program to try understand buffer overflows. I am trying to overflow the input buffer so that flag gets changed to true and the program outputs "got here". The program is here (assume you have password.txt with <strong>hey</strong> in it):</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  
  int main(int argc, char **argv){
    int flag = 0;
  
    char pwd[5];
    char input[5];
  
    FILE *f = fopen("password.txt", "r");
  
    fscanf(f, "%s", pwd);
    fclose(f);
  
    strcpy(input, argv[1]);
  
    if(strcmp(input, pwd)){
      printf("wrong password!\n");
    }
    else{
      flag = 1;
      printf("correct password!\n");
    }
    if(flag){
      printf("you got into the secret place\n");
    }
    return 0;
  }
  </code></pre>
  
  <p>So on the stack we have something like this I guess:</p>
  
  <pre><code>[high addresses]
  flag   ---&gt; 4 bytes
  pwd    ---&gt; 8 bytes
  input  ---&gt; 8 bytes
  [low addresses]
  </code></pre>
  
  <p>So I think I just need to give the program just 17 bytes to overwrite the flag variable. So i gave it <strong>aaaaaaaaaaaaaaaaa</strong> but that didn't work. I had to give it <strong>a</strong> 23 times, so 23 bytes. Why is 17 bytes not enough?</p>