2. Stack, frame pointers & stack smashing

The following declaration of buf is stored on the stack:

char buf[] = "string";

[anim slides 20-39]

Stack Frame

Using the frame pointer (rbp on x86-64) we can ‘walk up’ the stack, following the chain of stack frames. A stack frame is the state kept by each procedure activation (we may sometimes refer to this as the activation record).

In the scheme we’ve seen, the first two things added to each frame are the caller’s program counter and frame pointer followed by local variables and other useful data.

The stack encodes some important things about execution:

1. History: we can see what yet-uncompleted calls have got us here; we could print a backtrace for debugging
2. Continuation: where we will go back to after we return (one-to-one for each active call)

Link to original

Stack Smashing

We can override data earlier in the stack if we’re not careful, and this could lead to abuse from a malicious actor.

char buf[10]; // we can only safely read 10 chars
scanf("%s", buf); // read data into buf
return 0;

[a 44-51]