First page Back Continue Last page Graphics
Your Own Loops (cont.)
If the input length is 250 characters or more, a single byte after the end of the buffer is overwritten with NULL.
With an upward growing stack, and a little endian machine (such as Intel), this means overwriting the LSB of the pointer right after the buffer with zero.
With the buffer size occupying most (but not all) of the previous 256 block, there is a very high probability that the new pointer points back into the buffer.
There is a good chance that this bug is exploitable!