Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is a “memory stomp”?

I just came across this blog post which mentions “stomping memory”:

a C++ program which is easily capable of stomping memory (something you probably have never even heard of if you were born in a managed code world.)

And in fact I have never heard of it!

So, what is this, a memory stomp, stomping memory? When does it occur?

like image 465
scravy Avatar asked Dec 02 '12 12:12

scravy


3 Answers

Memory is "stomped" when a piece of code manipulates memory without realizing that another piece of code is using that memory in a way that conflicts. There are several common ways memory can be stomped.

One is allocating, say, 100 bytes of memory but then storing something past the 100th address. This memory might be used to hold something completely different. This is particularly hard to debug because the problem will appear when something tries to access the victim that was stomped on, and the code that stomped on it may be totally unrelated.

Another is accessing memory after it was freed. The memory may be allocated for another object. Again, the code that shows the problem may be related to the newly-allocated object that got the same address and unrelated to the code that caused the problem.

like image 107
David Schwartz Avatar answered Oct 18 '22 21:10

David Schwartz


Very often it is a buffer overrun; as an example, this code:

char buffer[8];
buffer[8] = 'a';

will "stomp" on whatever happens to be in the next thing in memory after buffer. Generally speaking, 'stomping' is when memory is written to unintentionally.

like image 21
IronMensan Avatar answered Oct 18 '22 23:10

IronMensan


Other answers basically are correct, but I would like to give an example.

int a[10], i;       
for (i = 0; i < 11 ; i++)
    a[i] = 0;

int i, a[10];     
for (i = 0; i < 11 ; i++)
    a[i] = 0;

These samples may lead into infinite loop (or may not lead), because it is undefined behavior.

Very likely variable i in memory is stored just after array. So accessing a[10] could actually access i in other words it could reset loop counter.

I think it is good example that demonstrates memory "stomping".

like image 10
ST3 Avatar answered Oct 18 '22 23:10

ST3