Re: OS stopping stack buffer overflow exploits

From: Jesse Pollard (pollard@cats-chateau.net)
Date: Sun Jun 04 2000 - 15:09:13 EST

On Sun, 04 Jun 2000, Khimenko Victor wrote:
>In <200006041042.MAA12176@oboe.it.uc3m.es> Peter T. Breuer (ptb@it.uc3m.es) wrote:
>> "A month of sundays ago Florian Weimer wrote:"
>>> The C and C++ frontends only generate trampolines if you use a GNU
>>> extension (nested functions).
>
>> And I have no idea why they should want to: nesting is purely a
>> question of namespaces and syntactic scoping. It should impact
>> the implementation semantics not at all.
>
>Oh, yeah ? I eagerly wait your implementation of draw_table for sample
>below without trampolines (just remember: you can not alter for_each or
>use any information about it's implementation - there are exist sparate
>compilation units, you know). Oh, and of course such implementation
>should work in multi-threaded environment as well...

Only piece I haven't covered is the multi-threaded indirect... Though that
could be done by addressing an array via the thread id...

 /* example without tramploine */
 
#include <stdio.h>
 
/*
procedure for_each(_from,_to:integer;procedure _do(x:integer));
var
    i:integer;
begin
    for i:=_from to _to do
        _do(i);
end;
 
procedure draw_table;
var
    y:integer;
    procedure one_step(x:integer);
    begin
        write(x*y:4);
    end;
begin
    for y:=1 to 10 do begin
        for_each(1,10,one_step);
        writeln;
    end;
end;
begin
draw_table;
end.
*/
 
void for_each( int from, int to, void _do( int))
{
    int i;
 
    for (i = from; i <= to; i++) {
        _do(i);
    }
}
 
void one_step_a(int *y, int x)
{
    printf("%4d",x * *y);
}
 
static int *y1; /* pointer to data of function */
void one_step (int x) /* substitution for trampoline */
{
    int *y;
 
    y = y1;
    one_step_a(y,x);
    y1 = y;
}

void draw_table(void)
{
    int y;
 
    y1 = & y; /* new */
    for (y = 1; y <= 10; y++) {
        for_each(1,10,one_step);
        printf("\n");
    }
}
 
int main(void)
{
    draw_table();
    return(0);
}

output is:

tabby$ ./a.out
   1 2 3 4 5 6 7 8 9 10
   2 4 6 8 10 12 14 16 18 20
   3 6 9 12 15 18 21 24 27 30
   4 8 12 16 20 24 28 32 36 40
   5 10 15 20 25 30 35 40 45 50
   6 12 18 24 30 36 42 48 54 60
   7 14 21 28 35 42 49 56 63 70
   8 16 24 32 40 48 56 64 72 80
   9 18 27 36 45 54 63 72 81 90
  10 20 30 40 50 60 70 80 90 100

This goes back many years to the original "how is recursion implemented in
pascal". There ARE compilers that don't use trampoline code, just as there
are processors that don't have a hardware stack. Take a look at some of
the old lisp interpreters. 

-- 
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@cats-chateau.net

Any opinions expressed are solely my own.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Wed Jun 07 2000 - 21:00:19 EST