<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Interview questions: Stack direction</title>
	<atom:link href="http://kstruct.com/2007/04/16/interview-questions-stack-direction/feed/" rel="self" type="application/rss+xml" />
	<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/</link>
	<description>Matt Sheppard</description>
	<lastBuildDate>Tue, 16 Mar 2010 04:56:26 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: noname</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-1339</link>
		<dc:creator>noname</dc:creator>
		<pubDate>Wed, 26 Aug 2009 00:27:13 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-1339</guid>
		<description>The expression (&amp;b &gt; a) is undefined.

The result of comparing two pointers using  is defined only if the two pointers point to elements within the same array or structure.

The standard says nothing about the direction of the stack or if a stack even exists.</description>
		<content:encoded><![CDATA[<p>The expression (&amp;b &gt; a) is undefined.</p>
<p>The result of comparing two pointers using  is defined only if the two pointers point to elements within the same array or structure.</p>
<p>The standard says nothing about the direction of the stack or if a stack even exists.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: noone</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-1310</link>
		<dc:creator>noone</dc:creator>
		<pubDate>Tue, 05 May 2009 04:10:50 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-1310</guid>
		<description>Just use a recursive function and then print the addresses during the unwinding stage. You will find out if it grows up or down.. Isn&#039;t it ?</description>
		<content:encoded><![CDATA[<p>Just use a recursive function and then print the addresses during the unwinding stage. You will find out if it grows up or down.. Isn&#8217;t it ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: matt</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-1290</link>
		<dc:creator>matt</dc:creator>
		<pubDate>Wed, 04 Feb 2009 12:12:46 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-1290</guid>
		<description>That the variables are ints, I think, is irrelevant - They are just something which is allocated on the stack, and could be chars, unsigned ints, floats, structs or whatever. We&#039;re only ever comparing the pointers to them, not the actual values. Unless I&#039;m mistaken, the comparison of pointers (&amp;b &gt; a) would always be interpreted correctly as unsigned.

And in answer to &#039;dude&#039;, you may be right - I&#039;m not aware of how this kind of comparison fits against the C standard, though I can confirm it works as expected with GCC on at least a couple of platforms in practice.</description>
		<content:encoded><![CDATA[<p>That the variables are ints, I think, is irrelevant &#8211; They are just something which is allocated on the stack, and could be chars, unsigned ints, floats, structs or whatever. We&#8217;re only ever comparing the pointers to them, not the actual values. Unless I&#8217;m mistaken, the comparison of pointers (&amp;b &gt; a) would always be interpreted correctly as unsigned.</p>
<p>And in answer to &#8216;dude&#8217;, you may be right &#8211; I&#8217;m not aware of how this kind of comparison fits against the C standard, though I can confirm it works as expected with GCC on at least a couple of platforms in practice.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: eh</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-1289</link>
		<dc:creator>eh</dc:creator>
		<pubDate>Wed, 04 Feb 2009 12:00:26 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-1289</guid>
		<description>Surely you want unsigned ints so a stack growing from 0xffffff (or thereabouts) will be growing down. However with signed comparisons, 0x000000 will be seen as higher than 0xffffff.</description>
		<content:encoded><![CDATA[<p>Surely you want unsigned ints so a stack growing from 0xffffff (or thereabouts) will be growing down. However with signed comparisons, 0&#215;000000 will be seen as higher than 0xffffff.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: dude</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-662</link>
		<dc:creator>dude</dc:creator>
		<pubDate>Tue, 22 Apr 2008 23:13:39 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-662</guid>
		<description>Very late to the party,  but here&#039;s food for thought:

I&#039;ve been thinking about this recently, since I am prepping for upcoming interviews and re-exercising some old coding muscles.

Anyway,  this is more or less the solution I came up with... but, unless I am mistaken... it&#039;s not guaranteed to work by the C standard. The C standard (accoring to my sources, possibly dated) only guarantees comparisons of pointers by use of &lt; will work &quot;as expected&quot; when comparing pointers inside the same array.  

There are no guarantees that it will work in the way it is being used to solve this problem.

Have recent standards provided guarantees what happens when arbitrary pointers are compared?</description>
		<content:encoded><![CDATA[<p>Very late to the party,  but here&#8217;s food for thought:</p>
<p>I&#8217;ve been thinking about this recently, since I am prepping for upcoming interviews and re-exercising some old coding muscles.</p>
<p>Anyway,  this is more or less the solution I came up with&#8230; but, unless I am mistaken&#8230; it&#8217;s not guaranteed to work by the C standard. The C standard (accoring to my sources, possibly dated) only guarantees comparisons of pointers by use of &lt; will work &#8220;as expected&#8221; when comparing pointers inside the same array.  </p>
<p>There are no guarantees that it will work in the way it is being used to solve this problem.</p>
<p>Have recent standards provided guarantees what happens when arbitrary pointers are compared?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Matt</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-94</link>
		<dc:creator>Matt</dc:creator>
		<pubDate>Tue, 23 Oct 2007 08:22:19 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-94</guid>
		<description>Looks like the Wikipedia page has been rearranged a bit. The text below gives a bit of an idea of the suggested advantages. Sounds like it&#039;s not really a significant defence however, given that it just changes the required mode of attack.


http://en.wikipedia.org/wiki/Stack_buffer_overflow#Stacks_that_grow_up

Stacks that grow up

Within the topic of stack buffer overflows an often discussed but rarely seen architecture is one in which the stack grows in the opposite direction. This change in architecture is frequently suggested as a solution to the stack buffer overflow problem because any overflow of a stack buffer that occurs within the same stack frame can not overwrite the return pointer. Further investigation of this claimed protection finds it to be a naïve solution at best. Any overflow that occurs in a buffer from a previous stack frame will still overwrite a return pointer and allow for malicious exploitation of the bug. For instance, in the example above, the return pointer for foo will not be overwritten because the overflow actually occurs within the stack frame for strcpy. However, because the buffer that overflows during the call to strcpy resides in a previous stack frame, the return pointer for strcpy will have a numerically higher memory address than the buffer. This means that instead of the return pointer for foo being overwritten, the return pointer for strcpy will be overwritten. At most this means that growing the stack in the opposite direction will change some details of how stack buffer overflows are exploitable, but it will not reduce significantly in the number of exploitable bugs.</description>
		<content:encoded><![CDATA[<p>Looks like the Wikipedia page has been rearranged a bit. The text below gives a bit of an idea of the suggested advantages. Sounds like it&#8217;s not really a significant defence however, given that it just changes the required mode of attack.</p>
<p><a href="http://en.wikipedia.org/wiki/Stack_buffer_overflow#Stacks_that_grow_up" rel="nofollow">http://en.wikipedia.org/wiki/Stack_buffer_overflow#Stacks_that_grow_up</a></p>
<p>Stacks that grow up</p>
<p>Within the topic of stack buffer overflows an often discussed but rarely seen architecture is one in which the stack grows in the opposite direction. This change in architecture is frequently suggested as a solution to the stack buffer overflow problem because any overflow of a stack buffer that occurs within the same stack frame can not overwrite the return pointer. Further investigation of this claimed protection finds it to be a naïve solution at best. Any overflow that occurs in a buffer from a previous stack frame will still overwrite a return pointer and allow for malicious exploitation of the bug. For instance, in the example above, the return pointer for foo will not be overwritten because the overflow actually occurs within the stack frame for strcpy. However, because the buffer that overflows during the call to strcpy resides in a previous stack frame, the return pointer for strcpy will have a numerically higher memory address than the buffer. This means that instead of the return pointer for foo being overwritten, the return pointer for strcpy will be overwritten. At most this means that growing the stack in the opposite direction will change some details of how stack buffer overflows are exploitable, but it will not reduce significantly in the number of exploitable bugs.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Karthik Balaguru</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-93</link>
		<dc:creator>Karthik Balaguru</dc:creator>
		<pubDate>Tue, 23 Oct 2007 03:44:00 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-93</guid>
		<description>Hi,

Can you share your views for this hot discussion w.r.t &quot;direction of stack growth&quot; -

http://groups.google.co.in/group/comp.arch.embedded/browse_thread/thread/1243efba95ebc0/9aaf2f6c899007a9?hl=en&amp;

snapshot of the query :
Why some processors have stack growing downwards and others have stack growing upwards ?
Any advantages/disadvantages w.r.t both these designs. Which is the best model ?
I serached the internet, but i did not find a good link that explains these stuffs in detail.

Thx in advans,
Karthik Balaguru</description>
		<content:encoded><![CDATA[<p>Hi,</p>
<p>Can you share your views for this hot discussion w.r.t &#8220;direction of stack growth&#8221; -</p>
<p><a href="http://groups.google.co.in/group/comp.arch.embedded/browse_thread/thread/1243efba95ebc0/9aaf2f6c899007a9?hl=en&#038;amp" rel="nofollow">http://groups.google.co.in/group/comp.arch.embedded/browse_thread/thread/1243efba95ebc0/9aaf2f6c899007a9?hl=en&#038;amp</a>;</p>
<p>snapshot of the query :<br />
Why some processors have stack growing downwards and others have stack growing upwards ?<br />
Any advantages/disadvantages w.r.t both these designs. Which is the best model ?<br />
I serached the internet, but i did not find a good link that explains these stuffs in detail.</p>
<p>Thx in advans,<br />
Karthik Balaguru</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Karthik Balaguru</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-91</link>
		<dc:creator>Karthik Balaguru</dc:creator>
		<pubDate>Tue, 23 Oct 2007 03:31:48 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-91</guid>
		<description>Corrected Query :

What are the security advantages of doing(stack growth) it up ? Can you give me a clear link ?
I think, that link did not have any details about the advantages of doing it Up.

I find that in the wikipedia link provided in the above article, it is talking about stack overflow which would be present for implementations involving stack growth in downward direction.
That can happen for stack growing in upward direction also.
Even the crash can happen for implementations involving stack growth in both downward and upward direction.

But, there is no mention of specific disadvantage mentioned w.r.t Stack growing in upward direction.

I find these lines only in wikipedia w.r.t disadvantages . There is no mention of disadvantage w.r.t stack growing in downward direction -&gt;

“A disadvantage of stack based memory allocation is that a thread’s stack size can be as small as a few dozen kilobytes. Allocating more memory on the stack than is available can result in a crash due to stack overflow. Another disadvantage is that the memory stored on the stack is automatically deallocated when the function that created it returns, and thus the function must copy the data if they should be available to other parts of the program after it returns. ”

Thx in advans,
Karthik Balaguru</description>
		<content:encoded><![CDATA[<p>Corrected Query :</p>
<p>What are the security advantages of doing(stack growth) it up ? Can you give me a clear link ?<br />
I think, that link did not have any details about the advantages of doing it Up.</p>
<p>I find that in the wikipedia link provided in the above article, it is talking about stack overflow which would be present for implementations involving stack growth in downward direction.<br />
That can happen for stack growing in upward direction also.<br />
Even the crash can happen for implementations involving stack growth in both downward and upward direction.</p>
<p>But, there is no mention of specific disadvantage mentioned w.r.t Stack growing in upward direction.</p>
<p>I find these lines only in wikipedia w.r.t disadvantages . There is no mention of disadvantage w.r.t stack growing in downward direction -&gt;</p>
<p>“A disadvantage of stack based memory allocation is that a thread’s stack size can be as small as a few dozen kilobytes. Allocating more memory on the stack than is available can result in a crash due to stack overflow. Another disadvantage is that the memory stored on the stack is automatically deallocated when the function that created it returns, and thus the function must copy the data if they should be available to other parts of the program after it returns. ”</p>
<p>Thx in advans,<br />
Karthik Balaguru</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Karthik Balaguru</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-92</link>
		<dc:creator>Karthik Balaguru</dc:creator>
		<pubDate>Tue, 23 Oct 2007 03:28:24 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-92</guid>
		<description>What are the security advantages of doing(stack growth) it up ? Can you give me a clear link ?
I think, that link did not have any details about the advantages of doing it Up.

I find that in the wikipedia link provided in the above article, it is talking about stack overflow which would be present for implementations involving stack growth in upward direction. Even the crash can happen for implementations involving stack growth in upward direction.

But, there is no mention of specific disadvantage mentioned w.r.t Stack growing in upward direction.

I find these lines only in wikipedia w.r.t disadvantages . There is no mention of disadvantage w.r.t stack growing in downward direction -&gt;

 &quot;A disadvantage of stack based memory allocation is that a thread&#039;s stack size can be as small as a few dozen kilobytes. Allocating more memory on the stack than is available can result in a crash due to stack overflow. Another disadvantage is that the memory stored on the stack is automatically deallocated when the function that created it returns, and thus the function must copy the data if they should be available to other parts of the program after it returns. &quot;

Thx,
Karthik Balaguru</description>
		<content:encoded><![CDATA[<p>What are the security advantages of doing(stack growth) it up ? Can you give me a clear link ?<br />
I think, that link did not have any details about the advantages of doing it Up.</p>
<p>I find that in the wikipedia link provided in the above article, it is talking about stack overflow which would be present for implementations involving stack growth in upward direction. Even the crash can happen for implementations involving stack growth in upward direction.</p>
<p>But, there is no mention of specific disadvantage mentioned w.r.t Stack growing in upward direction.</p>
<p>I find these lines only in wikipedia w.r.t disadvantages . There is no mention of disadvantage w.r.t stack growing in downward direction -&gt;</p>
<p> &#8220;A disadvantage of stack based memory allocation is that a thread&#8217;s stack size can be as small as a few dozen kilobytes. Allocating more memory on the stack than is available can result in a crash due to stack overflow. Another disadvantage is that the memory stored on the stack is automatically deallocated when the function that created it returns, and thus the function must copy the data if they should be available to other parts of the program after it returns. &#8221;</p>
<p>Thx,<br />
Karthik Balaguru</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ravi K Reddy Yellasiri</title>
		<link>http://kstruct.com/2007/04/16/interview-questions-stack-direction/comment-page-1/#comment-90</link>
		<dc:creator>Ravi K Reddy Yellasiri</dc:creator>
		<pubDate>Fri, 29 Jun 2007 05:42:18 +0000</pubDate>
		<guid isPermaLink="false">http://kstruct.com/?p=155#comment-90</guid>
		<description>Nice one!
Thx</description>
		<content:encoded><![CDATA[<p>Nice one!<br />
Thx</p>
]]></content:encoded>
	</item>
</channel>
</rss>
