logoalt Hacker News

ori_blast Wednesday at 11:42 PM2 repliesview on HN

It will generate code to touch each page of the stack, because otherwise a very large stack allocation controlled by users (eg, in the case of a variable sized array) can be turned into a pointer to any location in memory by an attacker. Faulting in each page of the stack turns that into a crash.

There was a userspace thread library I came across a long time ago that used variable length arrays to switch between thread stacks; the scheduler would allocate an array of the right size to bump the stack pointer to the different thread's stack.


Replies

i80andyesterday at 4:10 PM

The engineers were so preoccupied with whether or not they could that they didn't stop to think if they should

saagarjhayesterday at 2:40 AM

Wow, that’s horrible.