Ethereal-dev: [Ethereal-dev] Does emem need guard pages?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gerald Combs <gerald@xxxxxxxxxxxx>
Date: Tue, 14 Feb 2006 15:14:39 -0600
Memory allocated by emem.c currently has the following layout:

  +--------+---+--------+---+--------+---+-------+
  | alloc1 | c | alloc2 | c | alloc3 | c | empty |
  +--------+---+--------+---+--------+---+-------+

where

  allocn: Memory allocated using ep_alloc() or se_alloc().
  c: Canary values placed after each memory allocation.
  empty: Unallocated (empty) space.

The canary values can be used to detect buffer overflows, but not
prevent them.  Would it be useful to add guard pages before and after
each block of memory, e.g.

  +----+--------+---+--------+---+--------+---+-------+----+
  | gp | alloc1 | c | alloc2 | c | alloc3 | c | empty | gp |
  +----+--------+---+--------+---+--------+---+-------+----+

The guard pages could be protected using mprotect(), which would trigger
a segmentation fault any time the gp memory was accessed.

Would the guard pages be useful, or are the canary values alone
sufficient for our needs?

Also, how can we more gracefully handle instances where the canary
values are overwritten?  Right now we just abort.