0

There is start of function:

cseg01:0001F4C8 Check_CDRom     proc near               ; CODE XREF: Init+Ap
cseg01:0001F4C8
cseg01:0001F4C8 var_24          = byte ptr -24h
cseg01:0001F4C8
cseg01:0001F4C8                 push    edx
cseg01:0001F4C9                 sub     esp, 20h
cseg01:0001F4CC                 mov     eax, offset sub_1F5A4
cseg01:0001F4D1                 mov     edx, cs
cseg01:0001F4D3                 call    _harderr_
cseg01:0001F4D8                 mov     char_disk_letter, 43h ; 'C'
cseg01:0001F4DF
cseg01:0001F4DF loc_1F4DF:                              ; CODE XREF: Check_CDRom+60j
cseg01:0001F4DF                 xor     eax, eax
cseg01:0001F4E1                 mov     al, char_disk_letter
cseg01:0001F4E6                 push    eax
cseg01:0001F4E7                 push    offset aCDataTitle_phd ; "%c:\\data\\title.phd"
cseg01:0001F4EC                 lea     eax, [esp+2Ch+var_24]
cseg01:0001F4F0                 push    eax
cseg01:0001F4F1                 call    sprintf_
cseg01:0001F4F6                 add     esp, 0Ch

My question is - how many bytes are allocated for sprintf(buff ?

My calculations:

There is

sub esp, 20

Then:

lea     eax, [esp+2Ch+var_24]

i.e. esp + 8.

And it's means sub esp, 20h and + 8 is esp = 24d;

And size of buffer sprintf = 24d.

Itself string "%c:\data\title.phd" has 19d bytes.

Am I right buffer for sprintf has 24d bytes?

black4
  • 333
  • 1
  • 6
  • 1
    It starts at [esp+8] and has no bounds where do you see a allocation lea loads the addrees and push uses it no size checking and a buffer overflow if it exceeds 0x20 bytes – blabb Oct 04 '23 at 04:00
  • I think it starts at [esp+8] and ends at rettaddr (start stack frame). From [esp+8] to start stack frame is 24d. I.e. -32d + 8d = 24d. – black4 Oct 04 '23 at 09:06

0 Answers0