| |||||||||||||
Security-improving technologies which could be deployed nowSecurity-improving technologies which could be deployed nowPosted Jul 4, 2006 23:14 UTC (Tue) by bluefoxicy (guest, #25366)In reply to: Security-improving technologies which could be deployed now by iabervon Parent article: Security-improving technologies which could be deployed now
So after a couple years I finally figured this one out. The stack grows up, that's fine; when strcpy() or friends are called, your buffer overflows into strcpy()'s stack frame, and then strcpy() returns to your attack code.
In other words, stack-grows-up architectures aren't any more resistant to buffer overflows (ok so if they overflow in the same function, i.e. via a for loop, then they're safe; this is almost never what happens).
(Log in to post comments)
|
|||||||||||||