Editing Buffer overflow (section)

===Buffer overflow protection===
{{Main|Buffer overflow protection}}

Buffer overflow protection is used to detect the most common buffer overflows by checking that the [[call stack|stack]] has not been altered when a function returns. If it has been altered, the program exits with a [[segmentation fault]]. Three such systems are Libsafe,<ref>{{cite web |url=http://directory.fsf.org/libsafe.html |title=Libsafe at FSF.org |access-date=2007-05-20}}</ref> and the ''[[StackGuard]]''<ref>{{cite web |url=https://www.usenix.org/publications/library/proceedings/sec98/full_papers/cowan/cowan.pdf |archive-url=https://ghostarchive.org/archive/20221009/https://www.usenix.org/publications/library/proceedings/sec98/full_papers/cowan/cowan.pdf |archive-date=2022-10-09 |url-status=live |title=StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks by Cowan et al. |access-date=2007-05-20}}</ref> and ''[[ProPolice]]''<ref>{{cite web|url=http://wiki.x.org/wiki/ProPolice |title=ProPolice at X.ORG |access-date=2007-05-20 |url-status=dead |archive-url=https://web.archive.org/web/20070212032750/http://wiki.x.org/wiki/ProPolice |archive-date=12 February 2007 }}</ref> [[GNU Compiler Collection|gcc]] patches.

Microsoft's implementation of [[Data Execution Prevention]] (DEP) mode explicitly protects the pointer to the [[Structured Exception Handler]] (SEH) from being overwritten.<ref>{{cite web |url=http://www.uninformed.org/?v=2&a=4&t=txt |title=Bypassing Windows Hardware-enforced Data Execution Prevention |access-date=2007-05-20 |archive-url=https://web.archive.org/web/20070430040534/http://www.uninformed.org/?v=2&a=4&t=txt |archive-date=2007-04-30 |url-status=dead }}</ref>

Stronger stack protection is possible by splitting the stack in two: one for data and one for function returns. This split is present in the [[Forth language]], though it was not a security-based design decision. Regardless, this is not a complete solution to buffer overflows, as sensitive data other than the return address may still be overwritten.

This type of protection is also not entirely accurate because it does not detect all attacks. Systems like StackGuard are more centered around the behavior of the attacks, which makes them efficient and faster in comparison to range-check systems.<ref>{{Cite journal |last1=Lhee |first1=Kyung-Suk |last2=Chapin |first2=Steve J. |date=2003-04-25 |title=Buffer overflow and format string overflow vulnerabilities |url=https://onlinelibrary.wiley.com/doi/10.1002/spe.515 |journal=Software: Practice and Experience |language=en |volume=33 |issue=5 |pages=423–460 |doi=10.1002/spe.515 |issn=0038-0644|url-access=subscription }}</ref>