Search code examples
c++securitycallstackunsafe

Is there a good way to destroy caller's stack in C++?


There are some tricks practicing C++ programmers do know like "Scope Guard" and maybe others involving references to temporaries.

I'm not a practicing C++ programmer, but I'd like to ask (of curiosity) if there is a way third party library could harm the callers' stack somehow. Maybe involving sudden destructors or some kind of other scoped lifetime magic?


Solution

  • way third party library could harm the callers' stack

    Whenever code from the third part library runs - whether an initialisation routine for a dynamically loaded library that the OS loader knows to call, or an explicit call from the client application code - it usually (in most OSes'/implementations' security model) has as much ability to screw with the stack (or any other memory) as the client application itself; for example:

    void library_code()
    {
        char x;
        char* p = &x;
        *(p - 2) = 23;  // undefined behaviour - may do nothing or anything,
                        // but usually overwrites stack or SIGSEGVs
        *(p + 54) = 99; // stacks might grow up or down, so may have to + or -
                        // from &x to address in-use stack memory...
    }