Subject: Re: Code on stack (Re: exploit with memcpy())
To: None <tech-userlevel@netbsd.org>
From: Ignatios Souvatzis <ignatios@theory.cs.uni-bonn.de>
List: tech-userlevel
Date: 07/04/2002 10:54:04
--IiVenqGWf+H9Y6IX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 04, 2002 at 12:21:30AM -0700, Jason R Thorpe wrote:
> On Thu, Jul 04, 2002 at 01:50:12PM +0900, TAMURA Kent wrote:
>=20
>  > It is interesting.
>  > I have heard gcc generates trampoline code on stack in some cases.
>=20
> Yes, it does, but only if you use the features that require it
> in your programs (e.g. nested functions).
>=20
> In any case, the majority of programs do NOT use trampolines, and
> so the biggest barrier to a no-execute stack was signals.  Once that
> is fixed, then we can at least provide the option to do so.

The procedure that seems appropriate is to have some flag in the executable
that tells the exec() call to turn stack executability on. The toolchain wo=
uld
create it, if necessary. (If the sysadmin hasn't {switched of, compiled out=
 of
the kernel} support of this.).

Regards,
	-is

--IiVenqGWf+H9Y6IX
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: 2.6.i

iQEVAgUBPSQNKDCn4om+4LhpAQG31wf/aqGGoeZ6yhJTVGGVGkEg69XPCt0m6JYx
a+K6wFG46qGZ5GciRwGmwoJtLYfeTsrEKF9VeQO3sn9EjQY7StcXSEC01aQX6ycq
9XP1YABrcB3+y363ws5OdllUd1EJNws7RP3QzrEe1VDny2hFJlRcgLEIdbiKHi5g
9PidcEjOlxu3+Okg+tUUilpE67zIwdwVz1SKbUcyIIqcwTn6Qb3O9fviDkeKrzh3
Kptk/Wb/PhYmh1SV9/3Myc34agRtB57VDhd/MXrQk4ZcIcDA/FgpFIF42tsJap1A
nloG91qKyCZpPc3xVCGRET4oPG2RaMk1JRuyJ3feIDA/mN+s+Jm7wg==
=7aoT
-----END PGP SIGNATURE-----

--IiVenqGWf+H9Y6IX--