一个关于缓冲区溢出的问题

Question

有如下的代码

int login() { 
    char username[8]; 
    char password[8]; 
    gets(username); 
    gets(password); 
    return check_match_in_database(username, password); 
} 

上面函数的部分汇编代码：
Pushl %ebp
movl %esp, %ebp
subl $40, %esp
leal -16(%ebp), %eax
movl %eax, (%esp)
call _gets
leal -24(%ebp), %eax
movl %eax, (%esp)
call _gets

题目要求：
如果用户名和密码都正确，就会调用login_ok函数，已知login_ok的地址为0x804013da，请构造一个input，使login_ok被调用.
（原文：In the normal process, if the username and the password are both ok, the function ‘login_ok’ will be called to indicate login success. We’ve already known that the address of ‘login_ok’ is 0x804013da. Can you construct an input to make the function ‘login_ok’ be called after ‘login’ returns? You need to specify the key bytes and their positions rather than the complete input. And give one brief explanation about your input. ）

Answer 1

用函数指针吧