Quote:
|
Originally Posted by class101 because that is a stack overflow not a heap overflow. |
No, It's a heap overflow.
The real program is like that.
a = getprocessheap();
a1 = heapalloc(a, ,XXX);
a2 = heapalloc(a, ,36);
readfile(pfile,a2,60,1,0);
heapfree(a2);
before readfile,the heap manage & date is:
0008D8F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0008D900 00 00 00 00 00 00 00 00 AB AB AB AB AB AB AB AB
0008D910 00 00 00 00 00 00 00 00 DD 02 06 00 00 14 EE FE
0008D920 78 01 07 00 78 01 07 00 EE FE EE FE EE FE EE FE
^-------last heap struct point
after readfile, the heap manage & data is:
0008D8F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0008D900 00 00 00 00 00 00 00 00 00 00 33 33 33 33 33 33
0008D910 33 33 33 33 33 33 33 33 34 34 34 34 35 35 35 35
0008D920 36 36 36 36 37 37 37 37 33 33 33 33 33 33 33 33
heap management struct and two point is overflowd.