CODEWITHSUNDEEP
c++
Kleysley
Kleysley

Reputation: 573

Will reading out-of-bounds of a stack-allocated array cause any problems in real world?

Even though it is bad practice, is there any way the following code could cause trouble in real life? Note than I am only reading out of bounds, not writing:

#include <iostream>

int main() {
  int arr[] = {1, 2, 3};
  std::cout << arr[3] << '\n';
}

Upvotes: 0

Views: 596

Answers (3)

Aykhan Hagverdili
Aykhan Hagverdili

Reputation: 29985

If you don't own the memory or you do own it but you haven't initialized it, you are not allowed to read it. This might seem like a pedantic and uselss rule. Afterall, the memory is there and I am not trying to overwrite anything, right? What is a byte among friends, let me read it.

The point is that C++ is a high level language. The compiler only tries to interpret what you have coded and translate it to assembly. If you type in nonsense, you will get out nonsense. It's a bit like forcing someone translate "askjds" from English to German.

But does this ever cause problems in real life? I roughly know what asm instructions are going to be generated. Why bother?

This video talks about a bug with Facebooks' string implementation where they read a byte of uninitialized memory which they did own, but it caused a very difficult to find bug nevertheless.

The point is that, silicon is not intuitive. Do not try to rely on your intuitions.

Upvotes: 0

dimo414
dimo414

Reputation: 48864

As mentioned, it is not "safe" to read beyond the end of the stack. But it sounds like you're really trying to ask what could go wrong? and, typically, the answer is "not much". Your program would ideally crash with a segfault, but it might just keep on happily running, unaware that it's entered undefined behavior. The results of such a program would be garbage, of course, but nothing's going to catch on fire (probably...).

People mistakenly write code with undefined behavior all the time, and a lot of effort has been spent trying to help them catch such issues and minimize their harm. Programs run in user space cannot affect other programs on the same machine thanks to isolated address spaces and other features, and software like sanitizers can help detect UB and other issues during development. Typically you can just fix the issue and move on to more important things.

That said, UB is, as the name suggests, undefined. Which means your computer is allowed to do whatever it wants once you ask it to execute UB. It could format your hard drive, fry your processor, or even "make demons fly out of your nose". A reasonable computer wouldn't do those things, but it could.

The most significant issue with a program that enters UB is simply that it's not going to do what you wanted it to do. If you are trying to delete /foo but you read off the end of the stack you might end up passing /bar to your delete function instead. And if you access memory that an attacker also has access to you could wind up executing code on their behalf. A large number of major security vulnerabilities boil down to some line of code that triggers UB in just the wrong way that a malicious user can take advantage of.

Upvotes: 2

Lala5th
Lala5th

Reputation: 1163

Depends on what you mean by stack. If it is the whole stack, then no, you can't do that, it will lead to a segmentation fault. Not because there is the memory of other processes there (that's not how it works), but rather because there is NOTHING there. You can heuristically see this by looking at the various addresses the program uses. The stack for example is at ~0x7f7d4af48040, which is beyond what any computer would have as memory. The memory your program sees is different from the physical memory.

If you mean read beyond the stack frame of the current method: yes, you can technically do that safely. Here is an example

void stacktrace(){
        std::cerr << "Received SIGSEGV. Stack trace:\n";
        void** bp;
        asm(R"(
                .intel_syntax noprefix
                mov %[bp], rbp
                .att_syntax
        )"
                : [bp] "=r" (bp));
        size_t i = 0;
        while(true){
                std::cerr << "[" << i++ << "] " << bp[1] << '\n';
                if(bp > *bp) break;
                bp = (void**) *bp;
        }
        exit(1);
}

This is a very basic program I wrote to see, whether I could manually generate a stack trace. It might not be obvious if you are unfamiliar, but on x64 the address contained in rbp is the base of the current stack frame. In c++, the stack frame would look like:

return pointer
previous value of rsp [rsp = stack pointer] <- rbp points here
local variables (may be some other stuff like stack cookie)
...
local variables <- rsp points here

The address decreases the lower you go. In the example I gave above you can see that I get the value of rbp, which points outside the current stack frame, and move from there. So you can read from memory beyond the stack frame, but you generally shouldn't, and even so, why would you want to?

Note: Evg pointed this out. If you read some object, beyond the stack that might/will probably trigger a segfault, depending on object type, so this should only be done if you are very sure of what you're doing.

Upvotes: 1

Related Questions