Everything about Stack buffer overflow
Software anomaly
In software, a stack buffer overflow or stack buffer overrun occurs when a program writes to a memory address on the program's call stack outside of the intended data structure, which is usually a fixed-length buffer. Stack buffer overflow bugs are caused when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer. This almost always results in corruption of adjacent data on the stack, and in cases where the overflow was triggered by mistake, will often cause the program to crash or operate incorrectly. Stack buffer overflow is a type of the more general programming malfunction known as buffer overflow. Overfilling a buffer on the stack is more likely to derail program execution than overfilling a buffer on the heap because the stack contains the return addresses for all active function calls. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Stack buffer overflowA 5-minute orientation
- Skim a recent paper: BASICS: Binary Analysis and Stack Integrity Checker System for Buffer Overflow MitigationInfluential work since 2022
- Pick up a classic book: The web application hacker's handbookThe most-reprinted book on the subject
- Read the landmark paper: SafeStack: Automatically Patching Stack-Based Buffer Overflow VulnerabilitiesCited 43 times
- Go sideways: Buffer overflowA closely related topic
- Go sideways: Return-oriented programmingA closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
SafeStack: Automatically Patching Stack-Based Buffer Overflow Vulnerabilities
Detection and prevention of stack buffer overflow attacks
Exploiting stack-based buffer overflow using modern day techniques
Microarchitectural Protection Against Stack-Based Buffer Overflow Attacks
Smart fuzzing method for detecting stack‐based buffer overflow in binary codes
BofAEG: Automated Stack Buffer Overflow Vulnerability Detection and Exploit Generation Based on Symbolic Execution and Dynamic Analysis
Automated exploit generation for stack buffer overflow vulnerabilities
Stack Memory Buffer Overflow Protection based on Duplication and Randomization
🆕 Influential since 2022
📚 Books worth reading
The web application hacker's handbookDafydd Stuttard, Marcus Pinto · 2007
HackingJon Erickson, Jon Erickson · 2003
Fundamentals of data structures in CEllis Horowitz · 1993
Forbidden CodeJon Erickson · 2004
Introduction to computing systemsYale N. Patt, Sanjay J. Patel · 2003
Fundamentals of data structures in CEllis Horowitz · 2008
Hacking Linux exposedBri Hatch, James Lee · 2001
Diesel engine maintenance training manual, U.S. Navy. February, 1946United States. Navy Dept. Bureau of Ships. · 1946
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Buffer overflow In programming and information security, a buffer overflow or buffer overrun is a bug whereby a program writes data to a buffer beyond the buffer's allocated…
- Return-oriented programming Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code despite the presence of security defenses…
- Sigreturn-oriented programming Sigreturn-oriented programming (SROP) is a computer security exploit technique that allows an attacker to execute code in presence of security measures…
- Heap overflow A heap overflow, heap overrun, or heap smashing is a type of buffer overflow that occurs in the heap data area. Heap overflows are exploitable in a different…
- NOP slide In computer security, a NOP slide, NOP sled or NOP ramp is a sequence of NOP (no-operation) instructions meant to "slide" the CPU's instruction execution…
- Buffer overflow protection Buffer overflow protection is any of various techniques used during software development to enhance the security of executable programs by detecting buffer…
- Blind return-oriented programming Blind return-oriented programming (BROP) is an exploit technique which can successfully create an exploit even if the attacker does not possess the target…
- Return-to-libc attack A "return-to-libc" attack is a computer security attack usually starting with a buffer overflow in which a subroutine return address on a call stack is…