Understanding and doing Code Injection in C

Question

I am a bit confused in the idea of code injection in C. If somebody could explain it and show how its done I would appreciate it.

So lets say in C you have some Cha

Answer 1

If you allocate a buffer on the stack, and it overflows, it writes onto the stack. The stack contains the return pointer for the function that allocated the buffer. So, if you overflow a buffer on the stack, you can set the return pointer to something arbitrary; thereby giving you control of the thread of execution.

As to actually injecting the code, that depends. The stack - or rather, the page containing it - is often set not to allow code execution; but historically it would have been possible to store small malicious programs in the buffer itself on the stack. Return oriented programming is a fairly new variant of the return-to-libc attack, both of which work around NX bits.