Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was reading about buffer overflows and I know that I can have a stack overflow and heap overflow. But since the stack and the heap meet at some point, would it be possible to overflow into one from the other?
It would be great if you could give an explanation regarding the execute permission in the heap space too.
A stack buffer overflow usually overwrites previous stack frames or the return address. The stack grows down and buffers within the stack "grow" (they don't) up.
On most systems, the stack grows down and is above the heap.
A stack overflow can't overwrite anything on the heap because the heap comes before the stack. An underflow however would force the stack to overflow, causing the program to crash before anything gets overwritten.
If pointers are unsigned integer, incrementing a pointer far enough could make it point to the heap. But since buffer overflows usually write to all the addresses in the overflowing buffer, the program will crash when it has gone beyond the beginning of the stack. And even if the stack begins at the highest address, there will be a NULL pointer dereference, attempts to write to text and attempts to write to read only data sections, before the heap comes.
On rare systems where the stack grows up and towards the heap, a stack buffer overflow could overwrite data on the heap, assuming the system does not create a no-man's-land between the stack and the heap.
Some systems automatically allocate memory to the stack as it grows, other have a pre-allocated area for the stack. Auto-growing stacks are limited by either policy, and/or on 64-bit systems: available memory and swap.
A normal buffer overflow on these systems won't hurt the heap because it hits the no-man's-land before the heap.
