[Valgrind-users] Return address check useful at all?

[Sebastian <sc...@nb...>]

Hi *,


Following the discussion a bit I am not sure watching the return address is
useful at all. The stackframes with local variables yes, but the return
address?


The thing is, if you clobber the return address in normal operation in your
program you will notice soon enough (ie there is no way not to notice) and
valgrind will be of little use telling you.

If you want to instrument your program to watch the return address for
security measures, then the solution is much easier than watching the return
address getting overwritten: keep a second stack and instrument all
call*/ret* variants to update/check that stack, too. If they differ, one
address changed.

Or did I miss a use to monitor the saved return address?


ciao,
Sebastian

-- 
-. sc...@nb... -. + http://segfault.net/~scut/ `--------------------.
-' segfault.net/~scut/pgp `' 5453 AC95 1E02 FDA7 50D2 A42D 427E 6DEF 745A 8E07
`- GBU-31 blueprints available. payment >500k$. hi echelon! -----------------'