Re: Why are variables stored on the stack?

CJ wrote:

Thanks for all the replies, this is an interesting discussion.

Here are a couple of points that occur to me:

1) Buffer overflows are a more serious security problem on the stack
than on the heap, because the program counter is stored on the stack
and not the heap, so that a malicious stack overflow can execute
arbitrary code. The heap is used for data exclusively, which is what I
meant by "separate data from executable code".

Even if a buffer on the heap overflows, the worst that can happen is
some (probably insignificant) data corruption. Since malloc()
generally allocates space in powers of 2, often an off-by-one error or
similar won't overwrite anything anyway, but will just land in the gap
between the end of the buffer and the next power of 2.

Actually the DieHard framework designed by Emery Berger implements a
similar idea. It randomises the location of heap allocations and tries
to "space them out", so that a small buffer overrun will simply write
to unused memory and not critical data.

See his site for more details:

<http://www.cs.umass.edu/~emery/>

.

Relevant Pages

  • [NEWS] Multiple ValiCert Security Problems
    ... * Enterprise VA Host Server for processing validation requests VA API ... Multiple buffer overflows exist in the CGI script, forms.exe, which is ... Analysis of the code and stack contents reveals that the unchecked buffer ...
    (Securiteam)
  • Re: Privilege-escalation attacks on NT-based Windows are unfixable
    ... >> All of these would put their data on the heap, not on the stack. ... you're trying to guard against deliberate attacks that take advantage ... Buffer overflow attacks only work if the buffer is in a part of memory that ...
    (comp.security.misc)
  • Re: Privilege-escalation attacks on NT-based Windows are unfixable
    ... >> All of these would put their data on the heap, not on the stack. ... you're trying to guard against deliberate attacks that take advantage ... Buffer overflow attacks only work if the buffer is in a part of memory that ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Why are variables stored on the stack?
    ... Buffer overflows are a more serious security problem on the stack ... not the heap, so that a malicious stack overflow can execute arbitrary ...
    (comp.lang.c)
  • Re: Why are variables stored on the stack?
    ... Buffer overflows are a more serious security problem on the stack ... not the heap, so that a malicious stack overflow can execute arbitrary ...
    (comp.lang.c)