Date: Fri, 14 Feb 1997 07:32:14 +0000 From: Robin Melville <robmel@innotts.co.uk> To: Stephen McKay <syssgm@devetir.qld.gov.au>, Charles Mott <cmott@srv.net> Cc: freebsd-chat@freebsd.org, syssgm@devetir.qld.gov.au Subject: Re: Trying to understand stack overflow Message-ID: <l03010d00af29c40b9066@[194.176.130.90]> In-Reply-To: <199702140448.OAA27909@ogre.devetir.qld.gov.au>
next in thread | previous in thread | raw e-mail | index | archive | help
At 2:48 pm +1000 14/2/97, Stephen McKay wrote: > [lots of useful background snipped...] >If you carefully manipulate the return address you can run code from the >same array you overflowed. In other words executing code within the stack frame. Can't the 386 MMU restrict execution to the Text page? That would solve the whole thing. >The real problem here is lack of bounds checking on memory objects. I >remember Dennis Ritchie (hmm, or was it Ken T?) claim that he had modified >his system C compiler so that every C pointer implied length as well as >starting location. Thus, every pointer and array access could be checked >for illegitimate accesses. The penalty is doubling the size of every pointer >plus a run time checking cost. Given the dramas people are having with >security nowadays, and the plummeting cost of RAM and CPU power, I think >such an option should be added to GCC with all speed. This would also add enormously to the stability of C applications. Memory leakage is the bugbear of everything written in C. I second the proposition wholeheartedly! Rob.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?l03010d00af29c40b9066>