一个堆栈溢出的例子

1.DLL lib

LIBRARY       " XXX.DLL "

EXPORTS
    Initialize               @ 1  PRIVATE
    

 

void  __stdcall Initialize( int  nParam1, int  nParam2, int  nParam3 = 0 )
... {
       ......
}

 2. 宿主程序

 

typedef  long  (WINAPI *  InitializeProc)( int  nParam1， int  nParam2)

 

InitializeProc pfnInitialize  =  (InitializeProc )GetProcAddress(hInstance,  " Initialize " );
if (m_pfnInitialize )
         pfnInitialize ( 1 , 2 );

 

===============

当callInitialize函数时按照stdcall压栈顺序，先把2，1，return addr 压入栈中，而实际上Initialize会把return addr当作第三个参数nParam3，一旦函数执行完毕，会把错误的地址作为return addr引起程序crash