Re: OS stopping stack buffer overflow exploits

From: Jamie Lokier (lk@tantalophile.demon.co.uk)
Date: Sun Jun 04 2000 - 10:44:59 EST


Peter T. Breuer wrote:
> Why so? When we do the call the return address gets pushed and we jump
> to the pointer. From then on the (nested) function execution is
> standard. It references locations in its frame on the stack for its
> local variables, and locations higher up the stack for the enclosing
> functions variables. The nested function isn't visible from anywhere
> else so the enclosing functions frame must be above it on the stack
> and the compiler can generate the right relative offsets for them.

The nested function's name is visible only to its lexical parents.
However, the parent function is allowed to pass the address of the
nested function to another function called by the parent.

The called function can be lexically unrelated. E.g. qsort in libc. So
the passed address must behave as a standard C function address.

qsort uses an unknown and possibly variable amount of stack, so the
"locations higher up in the stack" cannot be determined at compile time.
The only information passed around within qsort is the nested function
address, which must somehow encode the parent function's stack frame as
well as being a callable function address. GCC implements this with
trampolines.

have a nice day,
-- Jamie

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Jun 07 2000 - 21:00:18 EST