change return value of function with buffer overflow

Question

x86 system

I am trying to change the return value of a function. For example

int foo(){
   char buffer[12]; 
   gets(buffer);
   return 1;
}

int main(){
   int value;
   value = foo();
   return 0;
}

foo() always returns 1. I know that return values from functions are stored to %eax (so 1 is stored to %eax).Is there any way that i can reach and change %eax value? I am thinking that this can't happen because %eax doesn't appear in the stack!Am I right?

Answer 1

You will not be able to modify the value of EAX in that function through a buffer overflow for precisely the reason that you surmise. How could potentially take over program execution, however, since you can overwrite the entire stack frame, including the saved frame pointer and return address.

How to accomplish this seems to be outside of the scope of your question, but it will be dependent on whether or not ASLR is in use, stack canaries are in use, a non-executable stack is in place, etc.