it doesn't say what happens when you define a parameter in a procedure as being ASCIIZ but with no maximum length specified
What it is, is, "Address of a buffer" .. same as when you use " sz AS ASCIIZ * somevalue"
The difference is, when you state the length with " * somevalue", the compiler will limit how much data will be read or written; when you don't use "* somevalue" it won't... it just follows your instructions, reading until it hits a $NUL (or GPFs because it did not find one until it exceeded the owned memory), or writing WHATEVER YOU TELL IT and appending a $NUL... or GPFing because you tried to write into memory you don't own.
Btw in this example? Overwriting that UDT is not going to get you a GPF, because that is stored on the stack, and by definition you own the stack. Unfortunately, you are probably already using the area of the stack where your overrun is writing... for other variables. Oops. You have variables changing value mysteriously? Well, this is the easy way to do that.
As I said... when you use ambiguous-length ASCIIZ variables, you are in charge - and responsible. Great tool - once you learn how to use it.
MCM
Leave a comment: