Fighting stack corruption

sree_ec · 12-10-2010, 08:51 AM

Basically what I want to do is to alert the program itself when stack corruption happens, either through a signal or any other method and want to terminate it. I dont want the execution to continue and end up failing somewhere else in the code.

For this I want to know some things like this,

In C, how stack, heap etc are allocated when I am creating an executable?
Who determines how much memory my exe should use w.r.t heap , stack or any other segments?
Suppose I want to alert my program regarding a possible when stack gets corrupted, what is the best way to do it?
I know these are some random questions not much related to each other, but if you can give me some pointers regarding this, I may be able to explain my question better..

Thanks

ForzaItalia2006 · 12-10-2010, 12:22 PM

Quote:

Originally Posted by sree_ec

Basically what I want to do is to alert the program itself when stack corruption happens, either through a signal or any other method and want to terminate it. I dont want the execution to continue and end up failing somewhere else in the code.

I don't know what the background of your plans is, but such a feature is already (vaguely) implemented, at least in GCC. Check out the option -fstack-protector. This feature is a bit different from what you want to achieve, because it basically recognize the stack corruption on function exit, but maybe this helps you to get further pointers.

I personally think that it is not really easy to detect this in real-time, meaning on the first write attempt, but as another hint, you could check out how hardware watchpoints (e.g. in GDB) are implemented.

Quote:

Originally Posted by sree_ec

In C, how stack, heap etc are allocated when I am creating an executable?

Initially, when the program starts, the heap (data segment) and stack are allocated by the operating system and then enhanced by the program on purpose via malloc(3) calls or function calls (increasing/decreasing the stack). When you create/compile an executable, you don't yet have a stack. The stack is finally created/allocated at runtime.

Quote:

Originally Posted by sree_ec

Who determines how much memory my exe should use w.r.t heap , stack or any other segments?

This might not be generally true for all platforms/operating systems out there, but this could be determined by:

shell/system settings (e.g. ulimit)
address space limits (e.g. heap would run into the stack or vice-versa)

With regard to the segments and the initial sizes: check out the size(1) command on Linux, like

Code:

# size test.exe
   text    data     bss     dec     hex filename
   1332     528      16    1876     754 test.exe

Quote:

Originally Posted by sree_ec

Suppose I want to alert my program regarding a possible when stack gets corrupted, what is the best way to do it?

The question is where do you want to detect this? In the operating system kernel, in your user application code? The usual UNIX like alert method would be to use signals, but this greatly depends on your implementation.

I hope that these answers help you to find further pointers, if not feel free to ask,
Andi

sree_ec · 12-10-2010, 02:07 PM

Quote:

Originally Posted by ForzaItalia2006

I don't know what the background of your plans is, but such a feature is already (vaguely) implemented, at least in GCC. Check out the option -fstack-protector. This feature is a bit different from what you want to achieve, because it basically recognize the stack corruption on function exit, but maybe this helps you to get further pointers.

I personally think that it is not really easy to detect this in real-time, meaning on the first write attempt, but as another hint, you could check out how hardware watchpoints (e.g. in GDB) are implemented.

Initially, when the program starts, the heap (data segment) and stack are allocated by the operating system and then enhanced by the program on purpose via malloc(3) calls or function calls (increasing/decreasing the stack). When you create/compile an executable, you don't yet have a stack. The stack is finally created/allocated at runtime.

This might not be generally true for all platforms/operating systems out there, but this could be determined by:

shell/system settings (e.g. ulimit)
address space limits (e.g. heap would run into the stack or vice-versa)

With regard to the segments and the initial sizes: check out the size(1) command on Linux, like

Code:

# size test.exe
   text    data     bss     dec     hex filename
   1332     528      16    1876     754 test.exe

The question is where do you want to detect this? In the operating system kernel, in your user application code? The usual UNIX like alert method would be to use signals, but this greatly depends on your implementation.

I hope that these answers help you to find further pointers, if not feel free to ask,
Andi

You said stack is allocated at run time,but whether linker scripts play any role in this? Atleast in determining the starting address of these memory segments?
Is there any mechanism where I can know the pages where stack is allocated or not allocated and then try to alert my program when it writes into wrong page?[ I heard this somewhere but I never got what it really meant, thats why I am asking here]
Or Is there any way atleast I can know from which address to other, the stack will grow? [In a multithreaded application]?

Thanks for that size command. I never knew it..

ForzaItalia2006 · 12-12-2010, 07:36 AM

Quote:

Originally Posted by sree_ec

You said stack is allocated at run time,but whether linker scripts play any role in this? Atleast in determining the starting address of these memory segments?

That's true. By using a linker script, you are change segment start addresses. Here's also a document about howto set the stack address for e.g. embedded systems. Not sure if that helps you: http://sunsite.ualberta.ca/Documenta...e/ldint_5.html

Quote:

Originally Posted by sree_ec

Is there any mechanism where I can know the pages where stack is allocated or not allocated and then try to alert my program when it writes into wrong page?[ I heard this somewhere but I never got what it really meant, thats why I am asking here]

Mhhh, well the kernel obviously knows this. And from userspace, at least in GNU/Linux systems, you could use the /proc-filesystem, e.g. /proc/<pid>/maps

Andi

sree_ec · 12-15-2010, 02:17 PM

Quote:

Originally Posted by ForzaItalia2006

I don't know what the background of your plans is, but such a feature is already (vaguely) implemented, at least in GCC. Check out the option -fstack-protector. This feature is a bit different from what you want to achieve, because it basically recognize the stack corruption on function exit, but maybe this helps you to get further pointers.

Andi

I wrote a code to check this

Code:

#include <stdio.h>
#include <pthread.h>

void call_func1()
{

int a[10][100];
printf("Helloworld\n");

}

void* do_work(void* id)
{

int id1 = *(int*)id;

call_func1();
printf("Thread_id = %d\n",id1);
pthread_exit((void* )id);
return;


}
int main()
{

        int i=0;
        pthread_t thread_id;
        long stacksize;
        pthread_attr_t attr;
        void* status;
        
        pthread_attr_init(&attr);

        pthread_attr_getstacksize(&attr,&stacksize);
        printf("Default stack size = %lu\n",stacksize);

        stacksize = sizeof(int)*8*8+1000;
       pthread_attr_setstacksize(&attr,stacksize);
        printf("Default stack size = %lu\n",stacksize);

        pthread_create(&thread_id,&attr,do_work,(void*)&i);

        pthread_join(thread_id,&status);
        printf("Goodbye world\n");
        return 0;

}

I built my program by

Quote:

$ gcc stackcorrupter.c -fstack-protector -lpthread

command

The program executed without any error..I expected some error as you said after executing call_func1().
But did not get anything. I had assigned my thread a stack size of 1256 and declared an array of 8000bytes. This should have caused a stack overflow right? Or am I missing something here?

jiml8 · 12-16-2010, 12:49 PM

From man pthread_attr_setstacksize :

Quote:

The pthread_attr_setstacksize() function sets the stack size attribute of the thread attributes object referred to
by attr to the value specified in stacksize.

The stack size attribute determines the minimum size (in bytes) that will be allocated for threads created using
the thread attributes object attr.

The compiler is smart enough to recognize that you need more stack than the minimum defined. So, when you invoke that thread, you get enough stack.

Stack overflows are a bad thing and the system will try to stop that from happening.

If you want to overflow your stack, start writing to that array after you define it on the stack, and don't stop writing when you reach the end of the array.

ntubski · 12-16-2010, 02:44 PM

You didn't check the return value of pthread_attr_setstacksize() to see if it succeeded.

pthread_attr_setstacksize(3)

Code:

ERRORS

       pthread_attr_setstacksize() can fail with the following error:

       EINVAL The stack size is less than PTHREAD_STACK_MIN (16384) bytes.