DANGEROUS C Functions gets & strcpy (PicoCTF 2022 #04 buffer-overflow0) 

You have to pass “fstack-protector" when compiling with gcc

The segfault is triggered by overwriting the return address on the stack (changing its value to some random garbage makes the program try to jump to that address and read code from there which the OS does not allow and sends the segfault signal) how many bytes you need to modify depends on the layout of the stack. You can use a debugger and look at the addresses of the local variables or look at the disassembly to see how much space is being allocated on the stack, but in this particular case the extra four bytes are the space on the stack for the local variable input. The layout of the stack is return address, then input then the buffer (though the stack grows down so these end up at decreasing addresses). When you put an input less than 16 characters it fits into the buffer. If you put 16-19 characters it starts clobbering the local variable input, and only once you put in 20 or more characters does it start touching the return address and cause the segfault.

@@hedgechasing thanks for the explanation! I definitely have to look at it more

It's a bash feature called brace expansion.