Re: Partial Hardware Protection for Buffer Overrun Exploits

["Bob French" <bfrench2@cfl.rr.com>]

"Brian Catlin" <brianc@sannas.org> wrote in message
news:b7ka8l$bs6$1@slb6.atl.mindspring.net...
> "Warren W. Gay VE3WWG" <ve3wwg@cogeco.ca> wrote in message
> news:3E9D8AB6.4090009@cogeco.ca...
> > I am curious if anyone has discussed this idea before:
> >
> [snip]
>
> It seems to me, that the real root of the problem is the C language, and
its
> lack of a native string type (and the really crappy run-time library).
While

The problem isn't really the string type.  In C parameters for a subroutine
get pushed on the stack.  Must have read/write access.  The call instruction
pushes the return address.  Must have read/write access.  In the beginning
of the subroutine initialized local variables get pushed on the stack and
uninitialized variables have space allocated by moving the stack pointer
according to their size.  Must have read/write access.  Either string or
array or struct missapplied can step on that return address stored right in
the middle of read/write data.  The stack has other return addresses to
caller of the caller, etc.

The data on the stack can also contain a pointer to code.  A sort routine
can be passed the address of the routines that compare a pair of items and
swap a pair of items.  It isn't just return addresses that can be problems.

The call instruction in the write protected TEXT segment is safe.  The real
problem is that programmers fail to check necessary limits.  That isn't to
say that the checking is trivial.  If a string space (array of chars) is
allocated on the stack and passed to a subroutine there needs to be a limit
passed, or a constant limit, and the limit must be less than or equal to the
size of the array as allocated by all callers.

> these sorts of attacks probably aren't limited to C programs, I'd be
willing to
> bet that they are LOTS less prevalent in other languages.

Languages that allow the use of a pointer to memory have the issue.  Intel
x86 got the bounds checking instruction back in the days of 80186 but the
subroutine may not know the size of the buffer it is working with.  It seems
that information hiding happens.

> It also seems to me,
> that programming has been made too easy; there are lots of people out
there
> writing software that should really be out cleaning toilets instead.
>
>  -Brian
>
>

Bob