Article,
Smashing The Stack For Fun And Profit
Phrack, (November 1996)
Abstract
Over the last few months there has been a large increase of buffer\newlineoverflow vulnerabilities being both discovered and exploited. Examples\newlineof these are syslog, splitvt, sendmail 8.7.5, Linux/FreeBSD mount, Xt \newlinelibrary, at, etc. This paper attempts to explain what buffer overflows \newlineare, and how their exploits work.\parBasic knowledge of assembly is required. An understanding of virtual \newlinememory concepts, and experience with gdb are very helpful but not necessary.\newlineWe also assume we are working with an Intel x86 CPU, and that the operating \newlinesystem is Linux.\parSome basic definitions before we begin: A buffer is simply a contiguous \newlineblock of computer memory that holds multiple instances of the same data \newlinetype. C programmers normally associate with the word buffer arrays. Most \newlinecommonly, character arrays. Arrays, like all variables in C, can be \newlinedeclared either static or dynamic. Static variables are allocated at load \newlinetime on the data segment. Dynamic variables are allocated at run time on \newlinethe stack. To overflow is to flow, or fill over the top, brims, or bounds. \newlineWe will concern ourselves only with the overflow of dynamic buffers, otherwise\newlineknown as stack-based buffer overflows.
