On Thu, 11 Mar 2004 06:08, Rex Johnston wrote: > On Thu, 2004-03-11 at 17:04, Christopher Sawtell wrote: > > Neither your ubiquitous *86* machines nor, to my knowledge, any other > > computer chipset found in the current crop of personal machines is able > > to produce a hardware segfault on array bound errors or, stack protection > > errors, i.e. underflow, overflow or execution of code on the stack. > > Actually, the 386+ *does* have the ability to do this. > http://www.midpec.com/djgpp/protmode/index1_2.html > > Whether you want the compiler to generate segments for each of your data > structures is another matter.
However, if the compiler os generating the x86 return (RETN) instruction to handle procedure exit, the x86 protection mode does nothing to protect against stack buffer overrun exploits that alter the return address. There are software solutions to this in the linux world, such as the StackGuard or 'stack smashing protector' extensions to gcc e.g. http://www.trl.ibm.com/projects/security/ssp/ Gentoo would be an ideal distro for hardening with Stack Smashing Protection: http://www.gentoo.org/proj/en/hardened/propolice.xml
