Playing with stack

This is a discussion on Playing with stack within the C Programming forums, part of the General Programming Boards category; I was doing some testing with stack, and noticed that I can't change the return address of the main()-function. Why ...

  1. #1
    Registered User
    Join Date
    Sep 2008
    Posts
    4

    Playing with stack

    I was doing some testing with stack, and noticed that I can't change the return address of the main()-function. Why it's not working? Isn't the return address supposed to be in the stack? I managed to change the return address in one of my functions but not in main... Seems like it doesn't have return address or I can't get to it. Does anyone know what is the problem? Some of my code:
    Code:
    #include <stdio.h>
    int main()
    {
            char c[4];
            gets(c);
            return 0;
    }
    If I give random input, return address doesn't change(debugged with gdb), but if I put those instructions to a function, it changes the return address? Anyone have any information about stack when main() is called? Platform is Linux, compiler gcc. Appreciate your help!

  2. #2
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    And what processor, is it an x86 or say arm? x86 has the return address on the stack, that's for sure. If it's some other processor, it may not have the actual return address on the stack - a typical example would be ARM that has a register (LR aka R14 I think) to hold the return address. LR is pushed on the stack by the function if it calls other functions, so leaf-functions do not need to store/retrieve LR.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  3. #3
    Registered User
    Join Date
    Sep 2008
    Posts
    4
    x86. I have the above code compiled, and input for example:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaa

    Then I debug it, check the registers, EIP's value is not 4x'a' in hex. If I do that with a function, it changes the EIP's value, so stack and return address get overwritten, but the same thing doesn't happen in main() for some reason..

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by Tubee View Post
    x86. I have the above code compiled, and input for example:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaa

    Then I debug it, check the registers, EIP's value is not 4x'a' in hex. If I do that with a function, it changes the EIP's value, so stack and return address get overwritten, but the same thing doesn't happen in main() for some reason..
    It probably does, but there may be more "gunk" on the stack than you expect, perhaps.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  5. #5
    Registered User
    Join Date
    Sep 2008
    Posts
    4
    I get segmentation fault after I try to overflow the character buffer in gets(), so it seems like the stack is there kind of write protected.. This doesn't happen in my own functions. So the return address might as well be there, but I just can't overwrite it, at least like that. Anyways thanks for replies.

  6. #6
    spurious conceit MK27's Avatar
    Join Date
    Jul 2008
    Location
    segmentation fault
    Posts
    8,300
    Quote Originally Posted by Tubee View Post
    I get segmentation fault after I try to overflow the character buffer in gets(), so it seems like the stack is there kind of write protected.. This doesn't happen in my own functions. So the return address might as well be there, but I just can't overwrite it, at least like that. Anyways thanks for replies.
    The reason you got a seg fault is because you succeeded in overwriting the return address, so the program cannot complete, silly.
    C programming resources:
    GNU C Function and Macro Index -- glibc reference manual
    The C Book -- nice online learner guide
    Current ISO draft standard
    CCAN -- new CPAN like open source library repository
    3 (different) GNU debugger tutorials: #1 -- #2 -- #3
    cpwiki -- our wiki on sourceforge

  7. #7
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by Tubee View Post
    I get segmentation fault after I try to overflow the character buffer in gets(), so it seems like the stack is there kind of write protected.. This doesn't happen in my own functions. So the return address might as well be there, but I just can't overwrite it, at least like that. Anyways thanks for replies.
    Like MK27 says, if you overwrite the stack with "aaaaaaa", then it will jump to address 0x61616161, which is most likely not a valid address, so it will segfault.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  8. #8
    Registered User
    Join Date
    Sep 2008
    Location
    Toronto, Canada
    Posts
    1,832
    Who's to say that c[4] is necessarily in the stack segment for main. Perhaps it's in the data segment.

  9. #9
    Technical Lead QuantumPete's Avatar
    Join Date
    Aug 2007
    Location
    London, UK
    Posts
    894
    Quote Originally Posted by nonoob View Post
    Who's to say that c[4] is necessarily in the stack segment for main. Perhaps it's in the data segment.
    Erm, the standard?

    Variables declared in scope go on the stack unless they're static.

    QuantumPete
    "No-one else has reported this problem, you're either crazy or a liar" - Dogbert Technical Support
    "Have you tried turning it off and on again?" - The IT Crowd

  10. #10
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by QuantumPete View Post
    Erm, the standard?

    Variables declared in scope go on the stack unless they're static.

    QuantumPete
    Of course, that's not to say that the "data stack" is the same piece of memory as the "return stack". In architectures where the processor return stack is small, you could consider a separate "local variable" stack.

    Likewise, there are processors where the return value for several layers can be held in a register (29K comes to mine, where there are 128 registers used for "local variables and return address" in a circular buffer style - the back end of the buffer is spilled to memory when it's full, and filled back from memory when it gets empty. In between, the values are not in memory. However, memory is used for local variables that use up larger chunks of memory, such as strings or structs, so overflowing a string or writing outside of a struct may cause "strange" things to happen, but it will not necessarily affect the return address).

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  11. #11
    C++まいる!Cをこわせ!
    Join Date
    Oct 2007
    Posts
    23,012
    Quote Originally Posted by nonoob View Post
    Who's to say that c[4] is necessarily in the stack segment for main. Perhaps it's in the data segment.
    The point is, on x86, the return address and local variables are stored on the stack. Period.
    Quote Originally Posted by Adak View Post
    io.h certainly IS included in some modern compilers. It is no longer part of the standard for C, but it is nevertheless, included in the very latest Pelles C versions.
    Quote Originally Posted by Salem View Post
    You mean it's included as a crutch to help ancient programmers limp along without them having to relearn too much.

    Outside of your DOS world, your header file is meaningless.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. stack and pointer problem
    By ramaadhitia in forum C Programming
    Replies: 2
    Last Post: 09-12-2006, 12:41 AM
  2. infix evaluation using stack
    By lewissi in forum C++ Programming
    Replies: 0
    Last Post: 11-03-2005, 02:56 AM
  3. Question about a stack using array of pointers
    By Ricochet in forum C++ Programming
    Replies: 6
    Last Post: 11-17-2003, 10:12 PM
  4. error trying to compile stack program
    By KristTlove in forum C++ Programming
    Replies: 2
    Last Post: 11-03-2003, 06:27 PM
  5. Stack Program Here
    By Troll_King in forum C Programming
    Replies: 7
    Last Post: 10-15-2001, 06:36 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21