3 ms·
> You can trivially control the return address of the decoder. With a stack overflow? Stack overflows usually write to unmapped memory and cause a segmentation
by NobodyNada 7y ago
> You can trivially control the return address of the decoder.
With a stack overflow? Stack overflows usually write to unmapped memory and cause a segmentation fault; how would you use that to control the return address? Or perhaps you were thinking about a stack buffer overflow instead?
https://en.wikipedia.org/wiki/Stack_overflow https://en.wikipedia.org/wiki/Stack_overflow vs
https://en.wikipedia.org/wiki/Stack_buffer_overflow https://en.wikipedia.org/wiki/Stack_buffer_overflow
- rurban 7y agoIn this case it's the same. The max stack depth is known, and the overflow easily triggerable and controllable from outside. It cannot get much easier. Wikipedia is a bit confused.
- NobodyNada 7y agoIt’s trivial to cause a stack overflow (as in allocating too much memory and running out of stack space), but how would you overwrite the return address? From what I can tell, the attacker can only cause the application to allocate lots of memory, not to overwrite memory.
- rurban 7y agoMemory DOS will not happen with normal recursion, only a tradional stackoverflow. And by adding some content after the fixed number of [ or {, this will by on the stack as argument to the recursive function. There are so many possible exploits. See eg. https://jon.oberheide.org/files/infiltrate12-thestackisback.pdf https://jon.oberheide.org/files/infiltrate12-thestackisback.... or search for "stack overflow recursion exploit"