Timeline for Are call stack addresses predictable with all protections disabled?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 26, 2020 at 16:59 | comment | added | Maikkeyy | @Extrarius that made it a lot clearer with the examples, thanks! I've added them to the list of things that can affect the stack layout in my own answer to this question. If somebody knows another situation that lacks in the list, let me know :) | |
| Jul 26, 2020 at 16:48 | comment | added | Extrarius | Yes, I meant calling alloca with a variable (whether it depends on user input, program state, or something else). As for multiple code paths, an http server might have different paths to the query parser depending on the type of request (get, post, head, connect, etc), for example. If only a "GET handler" calls the query parser, you have one path, but if there is a separate "POST handler" that calls it also, you now have (at least) two possible stack setups inside the query parser. In more complicated scenarios, the path taken might not be directly controlled by the input. | |
| Jul 26, 2020 at 16:25 | comment | added | Maikkeyy | @Extrarius How does the use of alloca interrupt the overall stack layout? If a program uses two functions that call alloca with a specified size, then that will be the same upon every execution, right? Or do you mean that the code could use alloca with a variable size depending on some external parameters that could be different upon each execution? For the latter: let's say you perform a BOF in a query param of a webserver, then there is (probably) one handler/code path that handles it. Do you have examples of different code paths running the vulnerable code, as I can't think of any now :). | |
| Jul 26, 2020 at 15:47 | comment | added | Extrarius | The stack pointer can vary at a fixed point in execution because some functions in the call chain might use varying amounts of stack (alloca in C, for example). There can also be different code paths that execute the vulnerable code, which can result in very different environments (including wildly different stack pointer values). | |
| Jul 24, 2020 at 20:00 | answer | added | Maikkeyy | timeline score: 0 | |
| Jul 17, 2020 at 22:15 | vote | accept | Maikkeyy | ||
| Jul 17, 2020 at 18:44 | history | edited | Maikkeyy | CC BY-SA 4.0 |
clarification, edit
|
| Jul 16, 2020 at 20:33 | answer | added | multithr3at3d | timeline score: 3 | |
| Jul 16, 2020 at 20:23 | history | edited | Maikkeyy | CC BY-SA 4.0 |
added 4 characters in body; edited tags
|
| Jul 16, 2020 at 18:40 | history | asked | Maikkeyy | CC BY-SA 4.0 |