For buffer overflows, what is the stack address when using pthreads?

Posted by t2k32316 on Stack Overflow See other posts from Stack Overflow or by t2k32316
Published on 2010-03-08T16:30:57Z Indexed on 2010/03/08 16:36 UTC
Read the original article Hit count: 905

Filed under:

buffer-overflow

|

stack

|

address

|

pthreads

|

c

I'm taking a class in computer security and there is an extra credit assignment to insert executable code into a buffer overflow. I have the c source code for the target program I'm trying to manipulate, and I've gotten to the point where I can successfully overwrite the eip for the current function stack frame. However, I always get a Segmentation fault, because the address I supply is always wrong. The problem is that the current function is inside a pthread, and therefore, the address of the stack seems to always change between different runs of the program. Is there any method for finding the stack address within a pthread (or for estimating the stack address within a pthread)? (note: pthread_create's 2nd argument is null, so we're not manually assigning a stack address)

© Stack Overflow or respective owner

Related posts about buffer-overflow

Why is it 8 here,understanding buffer overflow

as seen on Stack Overflow - Search for 'Stack Overflow'
void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *ret; ret = buffer1 + 12; (*ret) += 8;//why is it 8?? } void main() { int x; x = 0; function(1,2,3); x = 1; printf("%d\n",x); } The above demo is from here: http://insecure.org/stf/smashstack… >>> More
Is there a buffer overflow helloworld for c++?

as seen on Stack Overflow - Search for 'Stack Overflow'
I tried the code provided by this question,but it doesn't work. How to contrive an overflow to wrap my head around? >>> More
Buffer Overflow (vs) Buffer OverRun (vs) Stack Overflow [closed]

as seen on Stack Overflow - Search for 'Stack Overflow'
Possible Duplicate: What is the difference between a stack overflow and buffer overflow ? What is the difference between Buffer Overflow and Buffer Overrun? What is the difference between Buffer Overrun and Stack Overflow? Please include code examples. I have looked at the terms in Wikipedia… >>> More
Illustration of buffer overflows for students (linux, C)

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello My friend is teacher of first-year CS students. We want to show them buffer overflow exploitation. But modern distribs are protected from simples buffer overflows: HOME=`perl -e "print 'A'x269"` one_widely_used_utility_is_here --help on debian (blame it) Caught signal 11, on modern… >>> More
C# Sockets Buffer Overflow No Error

as seen on Stack Overflow - Search for 'Stack Overflow'
I have one thread that is receiving data over a socket like this: while (sock.Connected) { // Receive Data (Block if no data) recvn = sock.Receive(recvb, 0, rlen, SocketFlags.None, out serr); if (recvn <= 0 || sock == null || !sock.Connected) { OnError("Error In Receive… >>> More

Related posts about stack

Java: immutability, overuse of stack -- better data structure?

as seen on Stack Overflow - Search for 'Stack Overflow'
I overused hashSets but it was slow, then changed to Stacks, speed boost-up. Poly's reply uses Collections.emptyList() as immutable list, cutting out excess null-checkers. No Collections.emptyStack(). Combining the words stack and immutability, from the last experiences, gets "immutable stack" (probably… >>> More
iTunes 9.0.2 hangs on launch on Mac OS X 10.6.2

as seen on Super User - Search for 'Super User'
My iTunes 9.0.2 hangs on launch in OS X 10.6.2. This doesn't happen all the time, only if I've been running for a while. Then it will recur until I restart. Similarly Safari 4.0.4 will hang in the flash player plugin when about to play a video. If I restart both these problems go away until later… >>> More
How to write Haskell function to verify parentheses matching?

as seen on Stack Overflow - Search for 'Stack Overflow'
I need to write a function par :: String -> Bool to verify if a given string with parentheses is matching using stack module. Ex: par "(((()[()])))" = True par "((]())" = False Here's my stack module implementation: module Stack (Stack, push, pop, top, empty, isEmpty) … >>> More
PSTN Trunk TDM400P Install on Asterisk / Trixbox

as seen on Server Fault - Search for 'Server Fault'
Hey All, I'm trying to get a TDM400P card with FXO module to connect to our PSTN line. The card is correctly detected by Linux: [trixbox1.localdomain asterisk]# lspci 00:09.0 Communication controller: Tiger Jet Network Inc. Tiger3XX Modem/ISDN interface I've run setup-pstn which… >>> More
how to clear stack after stack overflow signal occur

as seen on Stack Overflow - Search for 'Stack Overflow'
In pthread, After reaching yellow zone in stack, signal handler stop the recursive function by making it return however, we can only continue to use extra area in yellow zone, how to clear the rubbish before the yellow zone in the thread stack ? (Copied from "answers"): #include <pthread… >>> More