title: Why does this program causes a segfault?
body: <p>I am currently writing about stack overflows and created the following program below (for reference, I am using a 32-bit linux machine):</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  
  int main () {
      char foo[16];
      strcpy(foo, "AAAAAAAAAAAAAAAABBBBC");
  }
  </code></pre>
  
  <p>This program was compiled with</p>
  
  <pre><code> gcc stack_buffer_2.c -g -o stack_buffer_2 -fno-stack-protector
  </code></pre>
  
  <p>What this program does is:</p>
  
  <ul>
  <li>fill all "foo" array with 'A' chars</li>
  <li>fill saved EBP with 'B' chars</li>
  <li>write 'C' char (plus null char) to saved ESP</li>
  </ul>
  
  <p>I verified the behavior of this program in GDB andhere is what I got:</p>
  
  <pre><code>(gdb) run
  
  Program received signal SIGSEGV, Segmentation fault.
  0xb7e30043 in ?? () from /lib/i386-linux-gnu/libc.so.6
  </code></pre>
  
  <p>The program tried to jump to 0xb7e30043 (overflown value, with 0x43 and null terminator) instead of the original value 0xb7e31637, which is a return point from __libc_start_main, in this context.</p>
  
  <p>Here is where things get tricky for me. Doing a "info proc mappings", I see that 0xb7e30043 seems to be like "valid" memory (inside /lib/i386-linux-gnu/libc.so.6)</p>
  
  <p>I am aware that segfaults can be triggered by memory I don't "own", or to unmapped segments. But in this case, since this is inside the memory space from my application, and libc is mapped to it, why I am getting a segfault?</p>
  
  <p>I suspect this is due to some kind of misalignment, since after the overflow EIP is pointing to a random instruction inside libc. If it is, how can I adjust it? What are the constraints behind it, and who enforces it? The kernel, the MMU?</p>