Re: Parameter Overflow Attack?

• Previous message: Bill Unruh: "Re: Looking at the typed password"
• In reply to: Walter Roberson: "Re: Parameter Overflow Attack?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: roberson@ibd.nrc.ca (Walter Roberson)
Date: 29 Nov 2002 03:38:03 GMT

In article <as5plf$rg3$1@canopus.cc.umanitoba.ca>,
Walter Roberson <roberson@ibd.nrc.ca> wrote:
:I would also point out to you that if you look at <varargs.h>
:or <stdarg.h> then the code for va_arg(), which {deliberately}
:has the side-effect of leaving you ready for the next parameter,
:does the adjustment by *adding* the parameter size to the previous
:pointer. This only works if the calling convention is that the
:arguments are arranged into increasing memory -- which would
:imply pushing in normal order if "pushing onto the stack" increases
:the stack pointer, and pushing in reverse order if "pushing onto the
:stack" decreases the stack pointer. See the code at
:http://nemesis.sourceforge.net/browse/h/ix86/stdarg.h.html

http://www.leto.net/mail/linuxasm/2000/msg00818.html
has a description of the gcc calling convention for Intel machines.
It does use left-to-right ordering, the stack growing downwards;
it -also- uses frame pointers.

http://www.home.ix.netcom.com/~stonybrk/env/index575.htm
indicates the calling conventions for a number of different architectures.
Of the ones it shows, only Windows 16-bit IA-32 ABI is
left-to-right; the 32-bit ABI is right-to-left.

It appears on closer examination that IRIX grows its stack downwards.
I had difficulty finding an explicit statement of this; it can
be deduced from the code example at
http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi?coll=0650&db=bks&srch=n64&fname=/SGI_Developer/Mpro_n32_ABI/sgi_html/ch04.html.uk> <as5plf$rg3$1@canopus.cc.umanitoba.ca>

This would in fact be consistant with the "standard C calling convention"
that I had objected to: at the time I objected, I was considering stacks
to grow upwards. The MIPS architecture does not have explicit stack
operations such as push and pop, so the stack direction could have gone
either way; either way, the arguments end up in increasing-memory order.

--
   *We* are now the times.                  -- Wim Wenders (WoD)

• Next message: Dazz: "Re: A Royal Name"
• Previous message: Bill Unruh: "Re: Looking at the typed password"
• In reply to: Walter Roberson: "Re: Parameter Overflow Attack?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]