Questions tagged [stack-smash]

Stack smashing is a buffer overflow vulnerability which is characterized by writing data outside the size of a stack-allocated buffer, causing corruption of a neighboring stack frame and potentially permitting execution of malicious code. Use this tag for questions about `stack smashing detected` and similar runtime errors, code with vulnerable buffers and other security risks related to stack smashing. See also: [buffer-overflow] and [buffer-overrun].

In software, a stack buffer overflow (also known as stack smashing) occurs when a program writes to a memory address on the program's call stack outside of the intended data structure, which is usually a fixed length buffer. Stack buffer overflow bugs are caused when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer. This almost always results in corruption of adjacent data on the stack, and in cases where the overflow was triggered by mistake, will often cause the program to crash or operate incorrectly. Stack buffer overflow is a type of the more general programming malfunction known as buffer overflow (or buffer overrun).

This tag should be used for questions about stack smashing detected and similar runtime errors, code with vulnerable buffers and other security risks related to stack smashing. See also: and .

161 questions
27
votes
2 answers

How to debug 'Stack smashing detected'?

I have a complex c++ code. It's a FastCGI program, using the FastCGI C++ Class library. When I ask it for a very looooong url, I get: *** stack smashing detected ***: ./tileserve terminated Erreur de segmentation For real life applications, it's…
user1219721
  • 783
  • 1
  • 8
  • 16
18
votes
1 answer

Smashing the stack example3 ala Aleph One

I've reproduced Example 3 from Smashing the Stack for Fun and Profit on Linux x86_64. However I'm having trouble understanding what is the correct number of bytes that should be incremented to the return address in order to skip past the…
user4099632
17
votes
3 answers

what is stack smashing (C)?

Code: int str_join(char *a, const char *b) { int sz =0; while(*a++) sz++; char *st = a -1, c; *st = (char) 32; while((c = *b++)) *++st = c; *++st = 0; return sz; } .... char a[] = "StringA"; printf("string-1 length =…
Gonzalez
  • 209
  • 1
  • 2
  • 8
15
votes
2 answers

How to detect if stack smashing protection is enabled in an iOS app

I want to be able to check if stack smashing protection (-fstack-protector-all) is enabled in an iOS app built on Xcode 9 with a target of iOS 11. I built an app with -fstack-protector-all enabled in "Other C flags", and it does build and run, but…
craig65535
  • 3,439
  • 1
  • 23
  • 49
7
votes
4 answers

How to effect a return of a value from the _calling_ function?

I would like to be able to force a 'double-return', i.e. to have a function which forces a return from its calling function (yes, I know there isn't always a real calling function etc.) Obviously I expect to be able to do this by manipulating the…
einpoklum
  • 118,144
  • 57
  • 340
  • 684
6
votes
1 answer

Stack Protection and Smashing using GCC

I am reading Smashing the Stack for Fun and Profit (in particular, this post refers to the "Buffer Overflows" section). The article is written for a 32-bit machine however I am working on a 64-bit for which I take account in my examples. One…
incomplete
  • 63
  • 5
5
votes
4 answers

How do I provide stdin inputs from command line?

I am trying to perform a buffer overflow attack on a program for a class assignment. Both the attack program as well as the vulnerable programme is written by me. The vulnerable code uses scanf to read data from stdin. ./vulnerable <…
Lord Loh.
  • 2,437
  • 7
  • 39
  • 64
5
votes
1 answer

Enable stack canaries in ios swift

I was looking for a way to enable stack canaries for my ios application in swift but then i found that recent version of xcodes have the flag required to enable stack canaries is enabled by default. So then i was looking for a way to ensure the…
XiOS
  • 1,665
  • 2
  • 18
  • 22
5
votes
1 answer

Stack-based buffer overflow - challenge in C using scanf with limited input

As part of a security CS course, my class has been given the task of exploiting a vulnerability to beat a password check using a stack/buffer overflow. The code with the vulnerability is as follows: #include #include #include…
Murray
  • 315
  • 5
  • 21
5
votes
2 answers

Why does "stack smashing detected" not appear immediately after smashing?

I understand what is meant by "stack smashing detected". There are already a lot of questions here regarding this. But I didn't find an answer to the following question. Take the C code int main(int argc, char **args) { char puffer[5]; …
timmornYE
  • 708
  • 2
  • 8
  • 22
5
votes
3 answers

Buffer Overflow as homeowrk

Still learning this Buffer Overflow stuff for a security class, I'm trying to exploit the vulnerability in this application: //vuln.c #include int bof(char *str) { char buffer[12]; //BO Vulnerability strcpy(buffer,str); …
5
votes
1 answer

Skipping an instruction using stack smashing

I have been trying to skip an instruction by changing the return address through stack smashing. The following code skips a++ in main and prints an output of "1 3". I have executed this code on a 32-bit intel machine. #include void fun(int…
shashank
  • 53
  • 4
4
votes
1 answer

Buffer Overflow - SegFaults in regular user

Below is my code, both the vulnerable program (stack.c) and my exploit (exploit.c). This code works on a pre-packaged Ubuntu 9 that the prof sent out for windows users (I had a friend test it on his computer), but on Ubuntu 12 that I run on my iMac,…
4
votes
2 answers

Launch shell with inline assembly

I am working on a school assignment and I am completely stumped. The professor and TA have been of no help as every answer they provide to any student is some variation of "keep looking, the answer is there." I am trying to create a shell using this…
3
votes
4 answers

What is stack smashing and how do I fix it?

The purpose of this program is to determine if a number between 1 and 1000 is prime by testing its divisibility with the first 11 prime integers. The program functions properly with most inputs. However, when I input an integer such as 468, stack…
1
2 3
10 11