Buffer overflow and code execution on iSeries

"Walden H. Leverich" <WaldenL-z/[email protected]>
Newsgroups gmane.comp.lang.as400.mi
Message-ID <[email protected]>
On the Midrange-L list someone made the following comment about BIND and buffer overrun.
 
>remote execution via buffer overflow doesn't seem likely or possible on an iSeries box. 
 
Now, that got me thinking, and maybe I just need to go read Leif's book again, but... 
 
Program A has it's storage space, and let's say there's a field called 'FLD1' in that space, now, as we all know, when I call program B and pass it FLD1 as a parm, only the address goes over, so if FLD1 is 30 bytes in program A, but it's 60 bytes in program B I can overwrite whatever is in memory after FLD1 in program A. Now, that _might_ be FLD2, right? 
 
What if FLD2 is the pointer to program C. Could program B change the value in FLD2 such that on the next attempted call to program C I actually called something else? Is this where I'd get caught by the tagged-pointer validation? But couldn't I load the appropriate values into the memory to make a valid pointer, I know you can create one per-Leif's book. 
 
So, as I'm thinking about it, code execution via buffer overrun is unlikely, ne, VERY unlikely, on iSeries, but it _is_ possible. Right?
 
-Walden
 
------------
Walden H Leverich III
Tech Software
(516) 627-3800 x11
[email protected]
http://www.TechSoftInc.com <blocked::http://www.techsoftinc.com/> 

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)

 
_______________________________________________
This is the MI Programming on the AS400 / iSeries (MI400) mailing list
To post a message email: MI400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/mi400
or email: MI400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/mi400.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.