===================
== Andrew's Site ==
===================

Don't forget the null bytes

c programming system exploit

Just a link to a good post.

Why do I care about this? It’s because null bytes are not just string terminators. They may also terminate arrays, e.g. terminating the argv array. So, say you are overwriting a buffer, preparing it to be argv for an execve syscall. Make sure to put a null byte or execve will return an error and you’ll never get the result of the execve command you worked so hard for..

Why do we need a null terminator for the argv array if we pass argc? This is apparently a historical issue, as K&R did not originally mention a null terminator, but did use argc. Later, ANSI C required argv[argc] to be a null byte. See here.