Re: OS stopping stack buffer overflow exploits

From: Jeff Garzik (jgarzik@pobox.com)
Date: Sun Jun 04 2000 - 04:07:35 EST


On Sun, 4 Jun 2000, Ingo Oeser wrote:
> On Sat, Jun 03, 2000 at 07:48:17PM -0700, Matthew Dharm wrote:
> > Hrm... this could cause some problems for applications which use
> > self-modifying code (i.e. trampoline handlers, etc.)
>
> Could you please show a daily example of any *need* for
> trampolines? I mean code, which could only be implemented
> (efficiently) via trampolines.
>
> I never saw one generated by GCC and never wrote an explicit one
> by myself. So for what important piece of code we do need it and
> can't code it without trampolines?

A commercial Java compiler (the fastest one on the market AFAIK) uses
then, and IIRC Gnu Ada uses some features which are unfriendly to the
OS attempting to stop stack overflow exploits across the board.

A much better solution is libsafe. Check it out.

In any case, this thread has been beaten to death. Maybe we should all
just re-read the old threads? :)

        Jeff

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Jun 07 2000 - 21:00:18 EST