Linux-kernel mailing list archive 2000-23,: Re: OS stopping stack buffer overflow exploits

# Re: OS stopping stack buffer overflow exploits

Khimenko Victor (khim@sch57.msk.ru)
Sun, 4 Jun 2000 20:36:34 +0400 (MSD)

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Erik Andersen: "Re: [PATCH] fix for sysinfo(2) in 2.4.0-test1"
- Previous message: Leo Mauro: "Re: OS stopping stack buffer overflow exploits"
- Maybe in reply to: Robert Redelmeier: "OS stopping stack buffer overflow exploits"
- Next in thread: Khimenko Victor: "Re: OS stopping stack buffer overflow exploits"

In <20000604100337.B18912@nightmaster.csn.tu-chemnitz.de> Ingo Oeser (ingo.oeser@informatik.tu-chemnitz.de) wrote:
> On Sat, Jun 03, 2000 at 07:48:17PM -0700, Matthew Dharm wrote:
>> Hrm... this could cause some problems for applications which use
>> self-modifying code (i.e. trampoline handlers, etc.)

> Could you please show a daily example of any *need* for
> trampolines? I mean code, which could only be implemented
> (efficiently) via trampolines.

No problem. See sample below. It's STANDARD pascal without any GNU
extensions. Question: how information about placement of y (it's not
global variable) can be transferred in _do pointer ? for_each is defined
before it's known that one_step is nested procedure ! Answer: it's
stored in trampoline, generated in place where for_each is called from
draw_table. The same is true for Java compilers as well (it's used
for local classes - they should be able to access variables of procedure
where such classes are defined and they should be used in place of normal
classes as well).

> I never saw one generated by GCC and never wrote an explicit one
> by myself. So for what important piece of code we do need it and
> can't code it without trampolines?

Lots of Ada and Pascal code where such things are normal:
-- cut --
program table(output);
procedure for_each(_from,_to:integer;procedure _do(x:integer));
var
i:integer;
begin
for i:=_from to _to do
_do(i);
end;

procedure draw_table;
var
y:integer;
procedure one_step(x:integer);
begin
write(x*y:4);
end;
begin
for y:=1 to 10 do begin
for_each(1,10,one_step);
writeln;
end;
end;
begin
draw_table;
end.
-- cut --

P.S. GPC supports such code just fine.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

- Next message: Erik Andersen: "Re: [PATCH] fix for sysinfo(2) in 2.4.0-test1"
- Previous message: Leo Mauro: "Re: OS stopping stack buffer overflow exploits"
- Maybe in reply to: Robert Redelmeier: "OS stopping stack buffer overflow exploits"
- Next in thread: Khimenko Victor: "Re: OS stopping stack buffer overflow exploits"