title: Memcpy() works on out of bounds memory?
body: <p>I have been playing around with the idea that memcpy() could be used for malevolent purposes. I made several test applications to see if I could "steal" data in memory from different regions. I have tested three regions thus far, heap, stack, and constant( read only ) memory. The constant memory was the only one to crash in my tests, provoking an error from MinGW.</p>
  
  <p>Here is an example to illustrate my latest test :</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  
  void removeTerminatingCharacters( char ** string, const int length )
  {
      int i = 0;
  
      for ( ; i &lt; length; ++i )
          if ( !( *string )[i] )
              ( *string )[i] = '0';
  
      return;
  }
  
  int main()
  {
      int * naive = malloc( sizeof( int ) );
      *naive = 0;
  
      char * stolenData = malloc( 2000 );
  
      memset( stolenData, 0, 2000 );
      memcpy( stolenData, naive, 1999 );
      removeTerminatingCharacters( &amp;stolenData, 2000 );
  
      printf( "%s\n", stolenData );
  
      free( stolenData );
      return 0;
  }
  </code></pre>
  
  <p>Output :</p>
  
  <pre><code>0000-0:0Væ1lDk¦#:00000[æ0`Dk00p,:0-0:0MAIN=Computer0USERNAME=JohnDoe0USERPRO
  FILE=C:\Users\JohnDoe0WATCOM=C:\watcom0windir=C:\Windows00?æ1+Ik?000S?000000
  00000000000000000000000000000000000000000000000000000000000000000000000000000000
  00??????????????????????????000000                          00000000 000000?0?0?
  00000000000 0 0 ?0000000000 0000000000 0000 00000???????????????????????0???????
                          0        00000000000000000000000000000000000000000000000
  000000000000000000abcdefghijklmnopqrstuvwxyz000000ABCDEFGHIJKLMNOPQRSTUVWXYZ0000
  0000â000000Ü0£0P00000000000è0î0Ä 0000000000¬0000000000¦0000¦00000aßGpSsµtFTOd8fe
  ä?:0ú?:0-?:0T?:0)?:0`?:0£?:0-?:0p?:0?:0??:0+?:08?:0T?:0¦?:0µ?:0²?:0¶?:03?:0D?:0R
  ?:0ä :0- :0+ :0a :0v :0?!:0^!:0q!:0ë!:0ñ!:0+!:0±!:0¤":0P":0g":0ó":0¦":0+":0¦":0?
  #:0.#:0B#:0W#:0x#:0ë#:00000ALLUSERSPROFILE=C:\ProgramData0APPDATA=C:\Users\Chris
  topher\AppData\Roaming0asl.log=Destination=file0CLASSPATH=.;C:\Program Files (x8
  6)\Java\jre6\lib\ext\QTJava.zip0CommonProgramFiles=C:\Program Files (x86)\Common
   Files0CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files0CommonProgram
  W6432=C:\Program Files\Common Files0COMPUTERNAME=COMPUTER0ComSpec=C:\Windows\sys
  tem32\cmd.exe0FPPUILang=en-US0FP_NO_HOST_CHECK=NO0HOMEDRIVE=C:0HOMEPATH=\Users\C
  hristopher0HuluDesktopPath=C:\Users\JohnDoe\AppData\Local\HuluDesktop\instan
  ces\0.9.13.1\HuluDesktop.exe0LOCALAPPDATA=C:\Users\JohnDoe\AppData\Local0LOG
  ONSERVER=\\COMPUTER0NUMBER_OF_PROCESSORS=20OnlineServices=Online Services0OOBEUI
  Lang=en-US0OS=Windows_NT0Path=.;F:\CodeBlocks\MinGW\bin;F:\CodeBlocks\MinGW;C:\M
  inGW\bin;C:\MinGW;C:\Windows\System32;C:\Windows;C:\Windows\System32\wbem;C:\Pro
  gram Files\Common Files\Microsoft Shared\Windows Live;C:\Program Files (x86)\Com
  mon Files\Microsoft Shared\Windows Live;C:\Windows\System32\WindowsPowerShell\v1
  .0;c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;c:\Program Files
  (x86)\Common F0Uô1m+k
  </code></pre>
  
  <p>My code isn't pretty, but it demonstrates my point. As you can see, the data is mostly garbage values, but there are a few interesting strings thrown in from the heap.</p>
  
  <p>My primary question is why doesn't this action cause a memory access violation error?</p>