I disassembled a simple C program (compiled by gcc) and the instructions responsible for placing the stack canary are the following:
mov %fs:0x28,%rax
mov %rax,-0x8(%rbp)
xor %eax,%eax
Note that the canary is eight bytes (rax
), yet, only four bytes (xor eax eax
) get cleared.
Is this intentional? It looks like the code just leaked a half of the stack canary.