Stack corruption in C++

问题:

In C++, in which way the stack may get corrupted. One way I guess is to overwriting the stack variables by accessing an array beyond its boundaries. Is there any other way that it can get corrupted?

回答1:

1. You could have a random/undefined pointer that ends up pointing to the stack, and write though that.
2. An assembly function could incorrectly setup/modify/restore the stack
3. Cosmic waves could flips bits in the stack.
4. Radioactive elements in the chip's casing could flip bits.
5. Anything in the kernel could go wrong and accidentally change your stack memory.

But those are not particular to C++, which doesn't have any idea of the stack.

回答2:

Violations of the One Definition Rule can lead to stack corruption. The following example looks stupid, but I've seen it a couple of times with different libraries compiled in different configurations.

header.h

struct MyStruct
{
   int val;
#ifdef LARGEMYSTRUCT
   char padding[16];
#endif
}

file1.cpp

#define LARGEMYSTRUCT
#include "header.h"

//Here it looks like MyStruct is 20 bytes in size    

void func(MyStruct s)
{
   memset(s.padding, 0, 16); //corrupts the stack as below file2.cpp does not have LARGEMYSTRUCT declared and declares Mystruct with 4 bytes
   return; //Will probably crash here as the return pointer has been overwritten
}

file2.cpp

#include "header.h"
//Here it looks like MyStruct is only 4 bytes in size.
extern void func(MyStruct s);

void caller()
{
   MyStruct s;
   func(s); //push four bytes on to the stack
}

回答3:

Taking pointers to stack variables is a good way:

void foo()
{
  my_struct s;
  bar(&s);
}

If bar keeps a copy of the pointer then anything can happen in the future.

Summing up: Stack corruption happens when there's stray pointers pointing to the stack.

回答4:

The C++ standard does not define stack/heap. Further, there are a number of ways to invoke undefined behavior in a program -- all of which may corrupt your stack (it's UB, after all). The short answer is -- your question is too vague to have a meaningful answer.

回答5:

Calling a function with the wrong calling convention.

(though this is technically compiler-specific, not a question of C++, every C++ compiler has to deal with that.)

回答6:

Throwing an exception inside a destructor is a good candidate. It would mess up the stack unwinding.