[4364] in bugtraq
Re: Smashing the Stack: prevention?
daemon@ATHENA.MIT.EDU (Alexander Snarskii)
Tue Apr 29 00:12:44 1997
Date: Mon, 28 Apr 1997 22:29:17 +0300
Reply-To: snar@lucky.net
From: Alexander Snarskii <snar@CARRIER.KIEV.UA>
X-To: nate@MILLCOMM.COM
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <Pine.LNX.3.95.970427164308.1982A-100000@amebix.monolith.org>
from "nate" at "Apr 27, 97 08:31:55 pm"
>
> 1. 'you gotta change the code'
> This one is obvious; people must change their SUID programs'
> source code to avoid nasty things like gets() sprintf() strcat() and
> strcpy() using things like fgets() strncat() strncpy() as substitutes.
Just one more way: replace ususal strcpy/sprintf/strcat
in libc to check stack integrity before exit, and generate
kill(SIGSEGV,getpid()) in case of violations.
That is a 'bad thing' from the performance point of view,
but not so bad (about 1% more time with stack
level 10); and that is not portable - because
stack checker must be written in assembler.
Sometimes ago i propagated such patches to FreeBSD team,
they did'nt commit it. If anyone interested:
ftp://ftp.lucky.net/pub/unix/local/libc-letter.
--
Alexandre Snarskii
the source code is included.
