I didn't compile the binary myself. It has no stack protections #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { volatile int modified; char buffer[64]; modified = 0; gets(buffer); if(modified != 0) { printf("you have changed the 'modified' variable\n"); } else { printf("Try again?\n"); } } The addresses of modified and buffer are printed above argv, which is nonsense. Also their true location is different, as evidenced by what strcpy modifies. print &modified $1 = (volatile int*) 0xffffcf3c print &argv $2 = (char***) 0xffffcf64
. *** This bug has been marked as a duplicate of bug 23220 ***