Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Allocating a buffer of more a page size on stack will corrupt memory?

In Windows, stack is implemented as followed: a specified page is followed committed stack pages. It's protection flag is as guarded. So when thead references an address on the guared page, an memory fault rises which makes memory manager commits the guarded page to the stack and clean the page's guarded flag, then it reserves a new page as guarded.

when I allocate an buffer which size is more than one page(4KB), however, an expected error haven't happen. Why?

like image 494
remainn Avatar asked Nov 08 '10 12:11

remainn


People also ask

Are buffer overflow vulnerabilities possible if the stack were to grow upwards in memory?

This question contains a false assumption: That growing a stack upward, instead of the significantly-more common downward, would alleviate stack overflow exploits. This is incorrect.

What is the difference between stack overflow and buffer overflow?

A stackoverflow is when the size of the stack for a thread exceeds the maximum allowable stack size for that thread. A buffer overflow is when a value is written into memory that is not currently allocated by the program.

What is Stackoverflow in C?

What is stack overflow? A stack overflow is a type of buffer overflow error that occurs when a computer program tries to use more memory space in the call stack than has been allocated to that stack.


2 Answers

Excellent question (+1).

There's a trick, and few people know about it (besides driver writers).

When you allocate large buffer on the stack - the compiler automatically adds so-called stack probes. It's an extra code (implemented in CRT usually), which probes the allocated region, page-by-page, in the needed order.

EDIT:

The function is _chkstk.

like image 176
valdo Avatar answered Nov 07 '22 05:11

valdo


The fault doesn't reach your program - it is handled by the operating system. Similar thing happens when your program tries to read memory that happens to be written into the swap file - a trap occurs and the operating system unswaps the page and your program continues.

like image 22
sharptooth Avatar answered Nov 07 '22 07:11

sharptooth