????4. ?????滻????&&sigaltstack????
?????????滻?????????????￡?
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <time.h>
#include <sys/types.h>
#include <execinfo.h>
void blackbox_handler(int sig)
{
printf("Enter blackbox_handler: ");
printf("SIG name is %s?? SIG num is %d "?? strsignal(sig)?? sig);
// ?????????
printf("Stack information: ");
int j?? nptrs;
#define SIZE 100
void *buffer[100];
char **strings;
nptrs = backtrace(buffer?? SIZE);
printf("backtrace() returned %d addresses "?? nptrs);
strings = backtrace_symbols(buffer?? nptrs);
if (strings == NULL)
{
perror("backtrace_symbol");
exit(EXIT_FAILURE);
}
for(j = 0; j < nptrs; j++)
printf("%s "?? strings[j]);
free(strings);
_exit(EXIT_SUCCESS);
}
long count = 0;
void bad_iter()
{
int a?? b?? c?? d;
a = b = c = d = 1;
a = b + 3;
c = count + 4;
d = count + 5 * c;
count++;
printf("count:%ld "?? count);
bad_iter();
}
int main()
{
stack_t ss;
struct  sigaction   sa;
ss.ss_sp = malloc(SIGSTKSZ);
ss.ss_size = SIGSTKSZ;
ss.ss_flags = 0;
if (sigaltstack(&ss?? NULL) == -1)
{
return EXIT_FAILURE;
}
memset(&sa?? 0?? sizeof(sa));
sa.sa_handler = blackbox_handler;
sigemptyset(&sa.sa_mask);
sa.sa_flags = SA_ONSTACK;
if (sigaction(SIGSEGV?? &sa?? NULL) < 0)
{
return EXIT_FAILURE;
}
bad_iter();
while(1);
return EXIT_SUCCESS;
}
???????? gcc –rdynamic blackbox_overflow.c ?????У???????
... ...
count:261989
count:261990
count:261991
count:261992
Enter blackbox_handler: SIG name is Segmentation fault?? SIG num is 11
Stack information:
backtrace() returned 100 addresses
./a.out(blackbox_handler+0x63) [0x400c30]
/lib/x86_64-linux-gnu/libc.so.6(+0x36ff0) [0x7f6e68d74ff0]
/lib/x86_64-linux-gnu/libc.so.6(_IO_file_write+0xb) [0x7f6e68db7e0b]
/lib/x86_64-linux-gnu/libc.so.6(_IO_do_write+0x7c) [0x7f6e68db931c]
/lib/x86_64-linux-gnu/libc.so.6(_IO_file_xsputn+0xb1) [0x7f6e68db84e1]
/lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0x7fa) [0x7f6e68d8879a]
/lib/x86_64-linux-gnu/libc.so.6(_IO_printf+0x99) [0x7f6e68d92749]
./a.out(bad_iter+0x7a) [0x400d62]
./a.out(bad_iter+0x84) [0x400d6c]
./a.out(bad_iter+0x84) [0x400d6c]
./a.out(bad_iter+0x84) [0x400d6c]
./a.out(bad_iter+0x84) [0x400d6c]
./a.out(bad_iter+0x84) [0x400d6c]
... ...
??????????????????滻???????????????????????????????????????????????????????????Ч???????????????????????
??????????????????????????sigaltstack???????ú??????????????????????????????????????ú????????á???????????麯???????????????t??????????????????????????????????????????????з???????????????????????????????????????????
?????ú?????????????￡?
????#include <signal.h>
????int sigaltstack(const stack_t *ss?? stack_t *oss);
?????ú?????????????????stack_t???????壬??????????????壺
????typedef struct {
????void  *ss_sp;     /* Base address of stack */
????int    ss_flags;  /* Flags */
????size_t ss_size;   /* Number of bytes in stack */
????} stack_t;
?????????????μ???滻??????ss_flags?????????0??ss_sp??ss_size?????????滻?????????????????С?????????????????SIGSTKSZ???ó??????????????滻?????????????????????MINSIGSTKSZ?漲????滻??????С???
??????????????????????????滻?????????ss_flags?????SS_DISABLE??
??????sigaltstack?????????????????μ???滻????????????????????????NULL????????NULL??????????????滻??????????????????檔???????????0????????-1.
?????????????????滻????????????￡?
??????????з????????????????滻????
???????sigaltstack()???????????滻???????????????
???????sigaction()???????????????????????????sa_flags?????SA_ONSTACK???????????????????????滻???????????С?