In the second of five films featuring Uli Drepper, he talks a little more about buffer overflows and another security implementation currently being used.
Learn a little about libc attacks stemming from buffer overflows and the canaries that serve to protect the stack in these emergencies.
It still can succeed if you remember at the point the function has not returned yet there can be variables or arguments still being used and if the function happens to overwrite a pointer to anyone of these that is controllable then u can overwrite the .IDATA security cookie or ("canary") so that the authoritive comparison is passed and both look the same. There is still ways around it even with SEH handler overwrites that completely bypasses this weak security. It's not completely secure.
sypha0x 4 years ago