Path: csiph.com!aioe.org!.POSTED!not-for-mail
From: Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm>
Newsgroups: comp.lang.forth
Subject: Re: Avoiding memory access vulnerabilities
Date: Sat, 27 Feb 2016 11:31:38 -0500
Organization: Aioe.org NNTP Server
Lines: 49
Message-ID: <20160227113138.5f8aa6da@_>
References: <2016Feb26.143842@mips.complang.tuwien.ac.at> <20160226171816.2a1470dc@_> <2016Feb27.081505@mips.complang.tuwien.ac.at>
NNTP-Posting-Host: n4wpt9zq8xR26Ttf9mo2BA.user.gioia.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Complaints-To: abuse@aioe.org
X-Newsreader: Claws Mail 3.13.1 (GTK+ 2.24.13; x86_64-unknown-linux-gnu)
X-Notice: Filtered by postfilter v. 0.8.2
Xref: csiph.com comp.lang.forth:45721

On Sat, 27 Feb 2016 07:15:05 GMT
anton@mips.complang.tuwien.ac.at (Anton Ertl) wrote:

> Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> writes:

> >Buffer overflows work in C because C uses a combined data stack and
> >return stack, i.e., stack frame.  
> 
> No.

Yes, that's why such attacks work in C, going all the way
back to the original Morris worm.

> Separating the return addresses is not sufficient to preventing
> arbitrary code execution.

True, but that wasn't in the scope of your original post.

> If return addresses were separate, attackers would overwrite
> function pointers.

Yes, if they can find them.  The entire reason that overflow
attacks are used is because:

1) they're easy, and
2) they work

Searching for pointers to functions in code, which may or may
not be over-writable, and which may or may not be executable,
isn't easy.  Accessing a stack with control-flow data or saved
return address via a register or simple function, such as the
return stack in Forth or a stack frame for most C implementations,
is much easier.

> >Forth words in the dictionary, while
> >they may contain an XT, are not buffers that can be written to
> >and overflowed via input and print string functions.  
> 
> Counterexample:
> 
> create buf 100 allot
> create two-xts ' . , ' . ,
> buf 1000 untrusted-file read-file

Then, you may need to separate buffer space and/or variable space
from code space and (fixed) data space.

variable space.