Questions tagged [stack-smash]

Stack smashing is a buffer overflow vulnerability which is characterized by writing data outside the size of a stack-allocated buffer, causing corruption of a neighboring stack frame and potentially permitting execution of malicious code. Use this tag for questions about `stack smashing detected` and similar runtime errors, code with vulnerable buffers and other security risks related to stack smashing. See also: [buffer-overflow] and [buffer-overrun].

In software, a stack buffer overflow (also known as stack smashing) occurs when a program writes to a memory address on the program's call stack outside of the intended data structure, which is usually a fixed length buffer. Stack buffer overflow bugs are caused when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer. This almost always results in corruption of adjacent data on the stack, and in cases where the overflow was triggered by mistake, will often cause the program to crash or operate incorrectly. Stack buffer overflow is a type of the more general programming malfunction known as buffer overflow (or buffer overrun).

This tag should be used for questions about stack smashing detected and similar runtime errors, code with vulnerable buffers and other security risks related to stack smashing. See also: and .

161 questions
2
votes
0 answers

Stack smashing detected - from C to assembly

I'm trying to translate from C to assembly two functions, one that sort an array of index and one that find the minimum number starting from an index. When I run the program it works , the new array is sorted but at the end it gives me this error 1…
Leonardo
  • 499
  • 1
  • 7
  • 18
2
votes
1 answer

Which stream does "stack smashing detected" message get printed to?

Consider the following very basic program, which has appeared in many forms on other questions here. #include int main() { char message[8]; strcpy(message, "Hello, world!"); } On my system, if I put this in a file called…
merlin2011
  • 71,677
  • 44
  • 195
  • 329
2
votes
1 answer

Modifying a ROP gadget

I have a ROP gadget which looks like this- p = "" p += pack('
Jai Asher
  • 53
  • 1
  • 6
2
votes
1 answer

C Buffer overflow - Return address not expressible in ASCII

I'm trying to overflow a buffer of 64bytes. The buffer is being filled by a call to gets My understanding is that I need to write a total of 65 bytes to fill the buffer, and then write another 4 bytes to fill the stack frame pointer. The next 4…
Guru Prasad
  • 4,053
  • 2
  • 25
  • 43
2
votes
1 answer

Convert int to string in hex format

While I was trying to do a smash-stacking exploit just like this article: http://www.cs.wright.edu/people/faculty/tkprasad/courses/cs781/alephOne.html, I ran across a problem of needing to convert the stack pointer into a string. I know how to…
Rock Lee
  • 9,146
  • 10
  • 55
  • 88
2
votes
1 answer

Can't figure out a smashing stack segment fault

I am doing some smashing stack practice recently with the book "shellcoder's handbook". But when I try to test some code on my Ubuntu11.04 I always get a segment fault. Here's the situation: At first I write exit_shellcode.s (just the simple exit(0)…
KUN
  • 527
  • 4
  • 18
1
vote
2 answers

Failed to get root shell while loading execl() function

#include #include #include int good(int addr) { printf("Address of hmm: %p\n", addr); } int hmm() { printf("Win.\n"); execl("/bin/sh", "sh", NULL); } extern char **environ; int main(int argc, char…
Adarsh Dinesh
  • 106
  • 12
1
vote
0 answers

Segmentation Fault when using list ADT

I am working on a school project and recently encountered a roadblock. I have tried to make date / time a pointer and to even use a dynamically allocated array but when I run this function I get a segmentation fault. When I change the code…
hrodric
  • 390
  • 2
  • 12
1
vote
2 answers

strtok() sometimes(??) causing stack smashing?

Using Kubuntu 22.04 LTS, Kate v22.04.3, and gcc v11.3.0, I have developed a small program to investigate the use of strtok() for tokenising strings, which is shown below. #include #include int main(void) { char inString[] =…
Stuart
  • 121
  • 7
1
vote
1 answer

Stack smash and sscanf

reply is S|[2 3 4 5 6 7 8 9]|[2 3 4 5 6 7 8 9] char com[10], f[100], s[100]; sscanf(reply, "%[^!]|%[^!]|%[^!]", com, f, s); It causes stack smash. I know that sscanf is usually unsafe, but I'm wondering why it fail here - when input string in…
Ben Usman
  • 7,969
  • 6
  • 46
  • 66
1
vote
1 answer

C code showing the error : *** stack smashing detected ***: terminated Aborted (core dumped)

I have a program in C that split an array into two sub_arrays , it's perfectly giving results for even & odd array.length , but i have this error : *** stack smashing detected ***: terminated Aborted (core dumped) And this is the C code…
bwass31
  • 65
  • 1
  • 10
1
vote
1 answer

Could switching VMs fix *** stack smashing detected ***

The scheduler I have been working on for my OS class has been getting a "*** stack smashing detected ***" error on the VM I'm using (I'm using Vagrant with virtualbox). This error occurs roughly 50% of the time I run the program. When switching to…
1
vote
1 answer

Reason for difference stack smashing behaviour between machines

We're trying to track down some stack smashing errors in some generated code. The problem is that the stack smashing errors are not 100% deterministic and only happens on one machine and not others. What possible reasons could there be for the…
svenningsson
  • 4,009
  • 1
  • 24
  • 32
1
vote
0 answers

X86_64 Assembly code segfaults and gives stack smashing error

So, for this assignment I have to write an Assembly "function" to be called by C code. The purpose of the function is, given an integer and a memory address (the address of a char array, to be used as a string), convert the integer to a string,…
1
vote
1 answer

How does gcc's -fstack-protector option prevent stack smashing?

I've been running into a stack-smashing issue and I'm having difficulty finding the cause. The stack smashing error only happens occasionally, and only at the very end of the program's execution. It also stops happening completely when I compile it…
hmarceau
  • 28
  • 1
  • 6
1 2
3
10 11