Re: Smashing the stack

> Some architectures grow the stack "upwards" in memory instead of
> "downwards"; this means that buffer overrun doesn't overwrite existing
> stack frames at all.

This doesn't follow at all. The buffer which is overrun could have
been allocated within a separate frame from the frame which actually
"commits" the overrun.

e.g.,

        foo()
        {
                char buf[10];
                gets(buf);
        }

The actual overrun occurs in gets(), which writes to memory which is
"below" the stack location of gets's frame, so (in the case of a
hypothetical machine with an upward-growing stack) the flow of control
is derailed on return from gets(), not return from foo()...

                                        - Bill
Received on Jan 21 1997