2 ms·
Therefore, if main() calls foo(), then foo() returns, the contents of the variables of foo() is still one frame higher on the frame stack and given the right me
by T-hawk 13y ago
Therefore, if main() calls foo(), then foo() returns, the contents of the variables of foo() is still one frame higher on the frame stack and given the right memory address you can still access it.
Unless an interrupt occurs between returning from foo() and reading those leftover stack variables. foo()'s abandoned stack space gets smashed by at least the return address from the interrupt handler, plus anything the handler itself pushes.
This falls into the class of use-after-free bugs. Like most instances of such, the technique works until something makes it not do so.
- IgorPartola 13y agoGreat point! Yes, that's exactly what this is: use-after-free. That's why I am saying that this is useful when you are trying to somehow break the program, but not useful when you are doing constructive things. Presumably, when you are trying to break the program, you can run it multiple times, and chances are that at some point the interrupt will not happen.