3 ms·
It's unclear how much stack-smashing is involved here. The "Control Flow Bending" paper clearly requires overwriting pointers internal to printf. Is this possi
by millstone 9y ago
It's unclear how much stack-smashing is involved here. The "Control Flow Bending" paper clearly requires overwriting pointers internal to printf.
Is this possible without invoking undefined behavior? FWIW the demos just crash with SIGILL on macOS.
- akkat 9y agoThis works by taking advantage of a format string exploit. It is by definition undefined behavior. It just so happens that this behavior is constant an gives the ability to change the flow of the program. At least in the popular glibc. However if someone were to rewrite how printf works but didn't allow the format string vulnerability, it would still be a valid c compiler.