可变堆栈大小
我的系统（linux 内核 2.6.32-24）正在实现名为地址空间布局随机化的功能（ASLR）。 ASLR 似乎改变了堆栈大小：
void f(int n)
{
printf(" %d ", n);
f(n + 1);
}
int main(...)
{
f(0);
}
显然，如果您执行该程序，就会出现堆栈溢出。问题在于每次执行时“n”的不同值都会发生分段错误。这显然是由 ASLR 引起的（如果禁用它，程序总是以相同的“n”值退出）。
我有两个问题：
- 这是否意味着 ASLR 使堆栈大小略有变化？
- 如果是这样，您认为这个事实有问题吗？可能是内核错误吗？
My system (linux kernel 2.6.32-24) is implementing a feature named Address Space Layout Randomization (ASLR). ASLR seems to change the stack size:
void f(int n)
{
printf(" %d ", n);
f(n + 1);
}
int main(...)
{
f(0);
}
Obviously if you execute the program you'll get a stack overflow. The problem is that segmentation fault happens on different values of "n" on each execution. This is clearly caused by the ASLR (if you disable it the program exits always at the same value of "n").
I have two questions:
- does it mean that ASLR make stack size slightly variable?
- if so, do you see a problem in this fact? Could be a kernel bug?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这可能意味着在一种情况下，堆栈恰好流入其他某个已分配的块，而在另一种情况下，它会越过未分配的地址空间。
It might mean that in one instance the stack happens to flow into some other allocated block, and in the other instance, it trips over unallocated address-space.
ASLR 代表“地址空间布局随机化”。它的作用是在每次运行时更改各个节/段的起始地址，是的，这包括堆栈。
这不是一个错误；而是一个错误。这是设计使然。其目的部分是为了通过溢出缓冲区来增加访问权限，因为为了执行任意代码，您需要欺骗 CPU“返回”堆栈上或运行时库中的某个点。合法的代码会知道返回到哪里，但一些预装的漏洞不会——它每次都可能是不同的地址。
至于为什么表观堆栈大小会发生变化，堆栈空间是以页为单位分配的，而不是以字节为单位。调整堆栈指针，特别是如果它不是页面大小的倍数，会改变您看到的可用空间量。
ASLR stands for "address space layout randomization". What it does is change various section/segment start addresses on each run, and yes, this includes the stack.
It's not a bug; it's by design. Its purpose, in part, is to make it harder to gain access by overflowing buffers, since in order to execute arbitrary code, you need to trick the CPU into "returning" to a certain point on the stack, or in the runtime libraries. Legitimate code would know where to return to, but some canned exploit wouldn't -- it could be a different address every time.
As for why the apparent stack size changes, stack space is allocated in pages, not bytes. Tweaking the stack pointer, especially if it's not by a multiple of the page size, changes the amount of space you see available.