Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #105369

Re: Stackoverflow, and how C uses stack to remember function calls

Show all headers | View raw

Respectfully,

Alla

On 3/4/17 15:04, Malcolm McLean wrote:
> On Saturday, March 4, 2017 at 11:59:55 AM UTC, Alla wrote:
>> On 3/4/17 14:53, Malcolm McLean wrote:
>>> On Saturday, March 4, 2017 at 11:41:51 AM UTC, Alla wrote:
>>>> Hello!
>>>>
>>>> One of the lectures touched upon the following:
>>>>
>>>> Before writing my question, I would like to say that I might have not
>>>> correctly written down the material, so it might sound incorrect, to say
>>>> the least; therefore, please, correct what I will write now and help me
>>>> to understand how it works, maybe with the help of some functions
>>>> (please, nothing too fancy and complicated). Please, read to the end
>>>> before answering because it might not be clear what I would like to ask
>>>> about and thus to understand.
>>>>
>>>> Below is an example a completely incorrect code that doesn't perform any
>>>> error checking, and used for illustration purpose. This program will
>>>> "blindly" copy one string into another. If the length of bar exceeds the
>>>> length of c, then something longer than allocated memory on stack will
>>>> creep into c's return address space (almost quoting), and worse yet
>>>> (here starts the part I would like your help on) as C language secretly
>>>> uses stack also to remember when the function is called and what is the
>>>> address of the previous function called, a "bad guy" can "jump back" to
>>>> that function using swap() (not in the code below) in the main(), and
>>>> this swap() not only swaps local variables/arguments, but also make
>>>> main() return back to the function to execute it; thus a computer
>>>> blindly assumes that bytes in that "address" part are the address to
>>>> which it should return. Therefore, these bytes might be some other,
>>>> rogue address, which the "bad guy" wants the program to go to - sort of
>>>> tricking the system. And this is done by copying more elements into the
>>>> c array.
>>>>
>>>> #include <stdio.h>
>>>> #include <string.h>
>>>>
>>>> void f(char *bar)
>>>> {
>>>>     char c[12];
>>>>     strncpy(c, bar, strlen(bar));
>>>> }
>>>>
>>>> int main (int argc, char **argv)
>>>> {
>>>>     f(argv[1]);
>>>> }
>>>>
>>>> How does this "redirection" happen, and what is actually happening
>>>> underneath the hood? As I understand it, when the program is compiled,
>>>> first a memory for
>>>> int main() with its local variables is allocated on the stack; if we
>>>> assume that a stack is a vertically placed rectangle, then the memory
>>>> block for the main function will be at the bottom. Next, as main()
>>>> contains a call to function f(), the memory for f and its local
>>>> variables is allocated "above" the memory for main(). When the program
>>>> is executed, once f() is called and finished its job, the memory on
>>>> stack is "cleared". So how that redirection can happen?
>>>>
>>>> Thank you very much!
>>>>
>>>
>>> The stack looks like this
>>>
>>> Return to OS address
>>> 12 bytes for variable 'c'
>>> Return to main address
>>>
>>> So in normal operation we write 12 or fewer bytes to c,
>>> and return to main.
>>>
>>> With the exploit, we write 12 bytes to c, then come extra bytes,
>>> corrupting our return address. If we are clever enough, we can
>>> manipulate that code to jump to an address of our own devising,
>>> where our own code lives.
>>>
>> Thank you for your reply. This is exactly my question: how can someone
>> manipulate that code; what is the example of the code that will make the
>> main() jump to the address that contains "bad code", based on the
>> program above? How is it possible by simply overflowing the memory
>> allocated for c?
>>
> Sorry, type "then come extra bytes", should read "then some extra bytes".
No worries ) I also do lots of typos these days )
>
> If we write 13 bytes to c, the last byte goes into the first byte of
> the function return to address, which is its location in main().
>

Back to comp.lang.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 14:40 +0300
  Re: Stackoverflow, and how C uses stack to remember function calls Malcolm McLean <malcolm.mclean5@btinternet.com> - 2017-03-04 03:53 -0800
    Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 14:58 +0300
      Re: Stackoverflow, and how C uses stack to remember function calls Malcolm McLean <malcolm.mclean5@btinternet.com> - 2017-03-04 04:04 -0800
        Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 15:12 +0300
    Re: Stackoverflow, and how C uses stack to remember function calls mark.bluemel@gmail.com - 2017-03-06 00:41 -0800
  Re: Stackoverflow, and how C uses stack to remember function calls David Brown <david.brown@hesbynett.no> - 2017-03-04 13:30 +0100
    Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 15:34 +0300
      Re: Stackoverflow, and how C uses stack to remember function calls David Brown <david.brown@hesbynett.no> - 2017-03-04 15:23 +0100
        Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 18:22 +0300
          Re: Stackoverflow, and how C uses stack to remember function calls Chad <cdalten@gmail.com> - 2017-03-04 07:53 -0800
        Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 19:29 +0300
  Re: Stackoverflow, and how C uses stack to remember function calls "James R. Kuyper" <jameskuyper@verizon.net> - 2017-03-04 11:18 -0500
    Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 20:10 +0300
      Re: Stackoverflow, and how C uses stack to remember function calls "James R. Kuyper" <jameskuyper@verizon.net> - 2017-03-04 13:18 -0500
        Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 22:43 +0300
    Re: Stackoverflow, and how C uses stack to remember function calls supercat@casperkitty.com - 2017-03-04 14:33 -0800
      Re: Stackoverflow, and how C uses stack to remember function calls Ian Collins <ian-news@hotmail.com> - 2017-03-05 11:50 +1300
        Re: Stackoverflow, and how C uses stack to remember function calls supercat@casperkitty.com - 2017-03-05 11:12 -0800
          Re: Stackoverflow, and how C uses stack to remember function calls Ian Collins <ian-news@hotmail.com> - 2017-03-06 17:11 +1300
            Re: Stackoverflow, and how C uses stack to remember function calls supercat@casperkitty.com - 2017-03-06 07:23 -0800
              Re: Stackoverflow, and how C uses stack to remember function calls David Brown <david.brown@hesbynett.no> - 2017-03-06 17:22 +0100
                Re: Stackoverflow, and how C uses stack to remember function calls scott@slp53.sl.home (Scott Lurndal) - 2017-03-06 16:40 +0000
                Re: Stackoverflow, and how C uses stack to remember function calls jm.bourguet@gmail.com - 2017-03-06 09:04 -0800
                Re: Stackoverflow, and how C uses stack to remember function calls scott@slp53.sl.home (Scott Lurndal) - 2017-03-06 17:18 +0000
                Re: Stackoverflow, and how C uses stack to remember function calls Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2017-03-06 11:22 -0700
                Re: Stackoverflow, and how C uses stack to remember function calls luser droog <luser.droog@gmail.com> - 2017-03-06 09:58 -0800
                Re: Stackoverflow, and how C uses stack to remember function calls luser droog <luser.droog@gmail.com> - 2017-03-06 10:04 -0800
  Re: Stackoverflow, and how C uses stack to remember function calls Barry Schwarz <schwarzb@dqel.com> - 2017-03-04 09:33 -0800
    Re: Stackoverflow, and how C uses stack to remember function calls Alla <vitale.alla@gmail.com> - 2017-03-04 22:46 +0300
  Re: Stackoverflow, and how C uses stack to remember function calls Keith Thompson <kst-u@mib.org> - 2017-03-04 12:25 -0800

csiph-web