3 ms·
Um, I might be wrong, but AFAIK exactly "knowing" where water will go is pretty hard, almost impossible nowadays because of some hardware/OS improvements (like
by krick 13y ago
Um, I might be wrong, but AFAIK exactly "knowing" where water will go is pretty hard, almost impossible nowadays because of some hardware/OS improvements (like randomising offset for example).
And "glass model" is still fine anyway. If you know that glass stands on the piece of sodium you know there'll be problems ;)
- pascal_cuoq 13y agoNo, the additional layers of protection such as NX and ASLR only make things a little more difficult, but do not prevent arbitrary code execution. One technique that was invented to circumvent this kind of preventive measure is http://en.wikipedia.org/wiki/Return-oriented_programming http://en.wikipedia.org/wiki/Return-oriented_programming . See also http://security.stackexchange.com/questions/20497/stack-overflows-defeating-canaries-aslr-dep-nx http://security.stackexchange.com/questions/20497/stack-over... The “glass over a piece of sodium” analogy is flawed too. It makes it sound like the program has to be special and dangerous for a buffer overflow to have dramatic consequences. It doesn't. It may be an ordinary program written to fulfill an ordinary task, and contain buffer overflows that are completely exploitable.