Okay let's talk about the answers.
Remember the quiz was about what is the source.
What did you or did not you do when tried to write the code for
that password checking program that resulted in a vulnerability?
So, the target password was too short,
this made it easy to overflow the buffer.
That's not the vulnerability, isn't it?
It doesn't matter how long the password is going to be.
Maybe you can expect people to have passwords that are 100 characters long.
But if you assumed the password was not going to be more than 100 characters,
and someone gave it 110 characters, the overflow would still happen.
So it's not the absolute length of the password that is the Issue.
The issue is that we allocate a certain amount of space for
the maximum, and the maximum could be anything.
So, it being too short is not the issue.
The code did not check the input and reject.
This actually is the source of the vulnerability.
Later we're going to remind you that secure coding,
golden rule is check your inputs.
We didn't check our inputs.
We made an assumption that the input will never be more than 12 bytes.
Because that's how much space we allocated for
the password string variable.
That's where we're going to store the input the user provides.
We made that assumption, what could have we done beyond that?
We could have, when we received the input, actually checked it.
If the input string is more than 12 bytes that's an overflow.
And we should have rejected and not gone on and done the comparison and
things like that.
So the code did not check input and
reject password strings that are longer than 12.
That is the vulnerability.
Correct answer here is,
the vulnerability arises because the input is not checked.
And when the input is not checked that results in overflow.
Over the last answer, the last answer says the code did not add extra,
unused variables.
First of all, there's no reason why you should add dummy variables, but
even if you did by making that input string longer and longer,
we can always sort of go past those local with the additional variables.
So, just adding additional variables.
Now, create some distance between the return address, and
where the password string variable is stored.
But, by giving longer input, we can go past those.
So that is not, again, a correct answer,
so the vulnerability here really is in that code that we have.
It's poor programming practice,
a lot of people unfortunately make that kind of mistake,
is the code did not check its input and because of that there was an overflow.
And overflow running into the return address.
And that gives the attacker a way to direct program control to some other
place where attacker crafted code may be available.