Thread: Can you tell me why this causes an infinite loop?

Yes, this is a test.

This only works on 64bit, replace 8 with 4 for 32bit.

Code:

#include <stdio.h>
#include <string.h>

int main()
{
    void *old_sp, *p = main;
    printf("int main()\n");
    asm("mov %0, rsp#" : "m="(old_sp));
    old_sp -= 8;
    memcpy(old_sp, &p, sizeof(p));
    printf("after memcpy");
    return 0;
}

What are you trying to do?

Because the return address is overwritten by the address of main, causing the return to go back to the main function. It should, however, crash with a stack underflow.

Assuming I read it correctly, I have to say I only glanced at it ;-)

I forgot to mention the rsp register, for 32 bit, it needs to be esp.

> It should, however, crash with a stack underflow.
It does seg fault, but from an overflow. cdecl removes args after the return, but that part is never reached because it returns to main.

The size of a pointer, on my box, 8. I printed it to test it, it is 8.

Are you sure it even compiles? I can't try, I'm running Linux, but this seems wrong:

Code:

old_sp -= 8;

I mean... Pointer arithmetics on a void pointer doesn't make much sense, does it?

A pointer is a pointer, whether it's to an int or void. The fundamental reason you can't do arithmetic on the void itself is because there's no block size(block size must be used in asm, because it must be encoded by the assembler, so the processor will know how arithmetic should function eg whether 255 + 1 should carry or overflow), the block size of any pointer is 64bits(again, on my box).

Run it to see. Here's my super-advanced utra-awesomo test:

Code:

#include <stdio.h>

int main()
{
   printf("%i\n", sizeof(void*));
   return 0;
}

It printed 8 for me.

Still at 1008. Pointer arithmetic changes what memory location is pointed to, not where the variable is.

And you would move p back 8 by-- what now?

Do you get it yet?

What makes you think it being a pointer has anything to do with 1008 - 8 == 1000? I move what it's pointing to so the return location is written to the right place on the stack. If you compile it and run it, it works. There's no other way to show you but for you to run it. It works.

Same as(In unsure as to why I didn't do it this way to begin with.):

Code:

#include <stdio.h>
#include <string.h>

int main()
{
    void *old_sp, *p = main;
    printf("int main()\n");
    asm("mov %0, rsp#" : "m="(old_sp));
    memcpy(old_sp - 8, &p, sizeof(p));
    printf("after memcpy");
    return 0;
}