Tràn bộ đệm và tràn ngăn xếp

static void kiem(int n) {
    char dem[16];
    int  canh_gac = 0x41424344;      /* de sau dem */
    memset(dem, 'X', (size_t)n);
    if (n < (int)sizeof dem) dem[n] = '\0';
    printf("ghi %2d byte -> canh_gac = 0x%08X %s\n",
           n, (unsigned)canh_gac,
           canh_gac == 0x41424344 ? "" : "<- DA BI DE LEN");
}

typedef struct {
    char ten[16];
    int  la_quan_tri;        /* NAM NGAY SAU ten */
} NguoiDung;

static void dang_nhap(const char *ten_nhap) {
    NguoiDung nd;
    memset(&nd, 0, sizeof nd);
    nd.la_quan_tri = 0;                 /* mac dinh: nguoi dung thuong */

    strcpy(nd.ten, ten_nhap);           /* KHONG kiem tra do dai */

    printf("  ten = \"%s\"\n", nd.ten);
    printf("  la_quan_tri = %d  %s\n", nd.la_quan_tri,
           nd.la_quan_tri ? "<<< DA THANH QUAN TRI VIEN" : "");
}

static void bi_mat(void) {
    printf("  >>> HAM NAY KHONG BAO GIO DUOC GOI TRONG MA <<<\n");
}

static void yeu(const char *dau_vao) {
    char dem[16];
    printf("  dia chi dem      = %p\n", (void *)dem);
    printf("  dia chi bi_mat   = %p\n", (void *)bi_mat);
    strcpy(dem, dau_vao);            /* KHONG kiem tra do dai */
    printf("  dem = %s\n", dem);
}

int main(int argc, char **argv) {
    const char *s = (argc > 1) ? argv[1] : "ngan";
    printf("dau vao dai %d byte\n", (int)strlen(s));
    yeu(s);
    printf("yeu() da tra ve binh thuong\n");
    return 0;
}

# gcc -O0 -fstack-protector-strong -S tran.c
yeu:
    ...
    movq    %fs:0, %rax          # doc gia tri canh gac tu vung dac biet
    movq    %rax, -8(%rbp)       # dat no ngay TRUOC dia chi tra ve
    ...
    call    strcpy               # neu tran, no de len canh gac
    ...
    movq    -8(%rbp), %rax       # doc lai canh gac
    xorq    %fs:0, %rax          # so voi gia tri goc
    je      .L3                  # bang nhau -> nhay qua, an toan
    call    __stack_chk_fail     # KHAC nhau -> abort ngay
.L3:
    ret

# Bo co cung hoa day du, giong cac ban phan phoi Linux dung
gcc -O2 \
    -D_FORTIFY_SOURCE=2 \
    -fstack-protector-strong \
    -fstack-clash-protection \
    -fPIE -pie \
    -Wl,-z,relro,-z,now \
    -Wl,-z,noexecstack \
    chuong-trinh.c -o chuong-trinh

# Kiem tra mot tep nhi phan da bat nhung gi:
#   Linux:  checksec --file=chuong-trinh
#           hardening-check chuong-trinh
# Ket qua mong doi: RELRO day du, canary co, NX co, PIE co.

const char *dai = "0123456789ABCDEF-THUA";   /* 21 ky tu */

/* 1. strncpy: KHONG bao dam ket thuc NUL */
char d1[16];
strncpy(d1, dai, sizeof d1);
/* 16 byte deu la du lieu, KHONG co NUL -> printf sau do doc tran */

/* 2. strncpy co sua tay */
char d2[16];
strncpy(d2, dai, sizeof d2 - 1);
d2[sizeof d2 - 1] = '\0';                    /* BAT BUOC them dong nay */

/* 3. snprintf: luon ket thuc NUL, tra ve do dai CAN THIET */
char d3[16];
int n = snprintf(d3, sizeof d3, "%s", dai);
if (n >= (int)sizeof d3) { /* da bi cat, xu ly */ }

/* 4. memcpy sau khi tu kiem tra */
char d4[16];
size_t n4 = strlen(dai);
if (n4 >= sizeof d4) n4 = sizeof d4 - 1;
memcpy(d4, dai, n4);
d4[n4] = '\0';