| |
| | w00w00-heap-overflows.txt |
 | | With the stack method, the advantage is that we can do whatever we want, and we don't require compatible function pointers (i.e., char (*funcptr)(int a) and void (*funcptr)() would work the same). |
 | | An attack that can beat Solar Designer's non-executable stack, but is caught by StackGuard, is to use two buffers: inject the attack code into the heap or static data areas, and use a classic stack smash to point the return address at the heap or static buffer. |
 | | The classic stack smash uses a single buffer, overflows it to corrupt the adjacent activation record, and simultaneously injects the attack code. |
| packetstormsecurity.nl /docs/infosec/buffer-overflows/w00w00-heap-overflows.txt (4942 words) |
|