1

I was reading about buffer overflows and I know that I can have a stack overflow and heap overflow. But since the stack and the heap meet at some point, would it be possible to overflow into one from the other?

It would be great if you could give an explanation regarding the execute permission in the heap space too.

1

A stack buffer overflow usually overwrites previous stack frames or the return address. The stack grows down and buffers within the stack "grow" (they don't) up.

On most systems, the stack grows down and is above the heap.

enter image description here

A stack overflow can't overwrite anything on the heap because the heap comes before the stack. An underflow however would force the stack to overflow, causing the program to crash before anything gets overwritten.

If pointers are unsigned integer, incrementing a pointer far enough could make it point to the heap. But since buffer overflows usually write to all the addresses in the overflowing buffer, the program will crash when it has gone beyond the beginning of the stack. And even if the stack begins at the highest address, there will be a NULL pointer dereference, attempts to write to text and attempts to write to read only data sections, before the heap comes.

On rare systems where the stack grows up and towards the heap, a stack buffer overflow could overwrite data on the heap, assuming the system does not create a no-man's-land between the stack and the heap.

Some systems automatically allocate memory to the stack as it grows, other have a pre-allocated area for the stack. Auto-growing stacks are limited by either policy, and/or on 64-bit systems: available memory and swap.

A normal buffer overflow on these systems won't hurt the heap because it hits the no-man's-land before the heap.

  • Thanks, but what do you mean when you say underflow? – Rowana Ravenclaw Nov 5 '16 at 18:19
  • Sorry, I did not understand this statement - 'A stack overflow can't overwrite anything on the heap because the heap comes before the stack.' What I understand is, you start on the stack with the higher address and move towards the lower addresses. And when I overflow, I overflow from the higher address to the lower address right? – Rowana Ravenclaw Nov 5 '16 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.