Extended Slovník

Stack Overflow

A stack overflow is a type of memory corruption vulnerability that occurs when a program attempts to write more data to the call stack than it has allocated, overwriting adjacent memory regions and potentially allowing an attacker to inject and execute malicious code.

What is a Stack Overflow Vulnerability?

A stack overflow vulnerability arises when a program attempts to write an excessive amount of data onto the program's call stack — a special region of memory that stores temporary variables, function parameters, and return addresses. When the allocated space for a function's stack frame is exceeded, data overflows into adjacent memory regions. This overflow can overwrite critical data, such as return addresses, allowing an attacker to divert program execution to arbitrary locations — typically to malicious shellcode.

The call stack operates on a Last-In, First-Out (LIFO) principle and has a finite amount of memory allocated by the operating system. Every time a function is called, a new stack frame is pushed onto the stack containing local variables, saved registers, and the return address. When a function writes beyond the boundaries of its allocated frame — often due to improper bounds checking — it corrupts the stack and creates a security vulnerability that can be exploited. According to the National Vulnerability Database (NVD), stack overflow vulnerabilities remain among the most commonly reported software flaws.

Why Are Stack Overflows Considered Dangerous?

Stack overflows are considered one of the most dangerous classes of software vulnerabilities for several critical reasons:

Arbitrary Code Execution: By overwriting the return address on the stack, an attacker can redirect program flow to execute injected malicious code (shellcode), potentially gaining full control of the system.
Denial of Service (DoS): Even without a sophisticated exploit, a stack overflow can crash an application or service, causing availability disruptions.
Information Disclosure: Overflows can expose sensitive data stored in adjacent memory locations, including cryptographic keys, passwords, or session tokens.
Privilege Escalation: If the vulnerable program runs with elevated privileges (e.g., as root or SYSTEM), a successful exploit can give the attacker full administrative access to the host.
Bypassing Security Controls: Advanced exploitation techniques such as Return-Oriented Programming (ROP) allow attackers to bypass modern defenses like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).

The OWASP Foundation and SANS Institute consistently highlight memory corruption vulnerabilities as top-priority risks in their security guidance.

When Does a Stack Overflow Typically Occur?

A stack overflow typically occurs in the following scenarios:

Unbounded Recursive Functions: A recursive function that calls itself indefinitely without a proper base case will continuously push new stack frames, eventually exhausting all available stack memory and causing a crash.
Unsafe String Operations: Using unsafe C library functions like strcpy(), gets(), or sprintf() without size limits to copy user-supplied input into a fixed-size buffer on the stack. For example, if a 256-byte buffer receives 512 bytes of attacker-controlled input, the excess data overwrites adjacent stack memory.
Large Local Variable Allocations: Declaring excessively large arrays or data structures as local variables within a function can consume the entire stack in a single frame.
Deeply Nested Function Calls: Complex call chains, particularly in event-driven or callback-heavy architectures, can exhaust the stack even without explicit recursion.
Improper Input Validation: Any situation where external data is used to determine how much data is written to a stack buffer without proper validation can lead to overflow conditions.

Which Programming Languages Are Most Susceptible to Stack Overflow?

Not all programming languages carry the same risk of stack overflow vulnerabilities:

Language Category	Risk Level	Reason
C / C++	High	Direct memory access, manual memory management, no built-in bounds checking on arrays or pointers.
Assembly	High	Complete control over the stack with zero automatic safety checks.
Objective-C	Moderate	Inherits C's memory model but some frameworks add safety layers.
Java / C# / Python	Low	Managed runtime environments with automatic bounds checking. However, stack exhaustion from deep recursion is still possible (e.g., `StackOverflowError` in Java).
Rust	Very Low	Strict compile-time memory safety guarantees prevent most buffer overflow conditions, though unsafe blocks bypass these protections.

Languages like C and C++ remain the most susceptible because they provide direct memory manipulation without enforcing safety boundaries. The vast majority of stack overflow CVEs cataloged in the MITRE CVE Database involve software written in these languages.

How to Prevent Stack Overflows in Software Development

Preventing stack overflow vulnerabilities requires a combination of secure coding practices, compiler-level protections, and runtime defenses:

Use Safe Functions: Replace unsafe functions like strcpy() and gets() with safer alternatives such as strncpy(), strlcpy(), fgets(), or snprintf() that enforce size limits.
Enable Stack Canaries: Modern compilers (GCC, Clang, MSVC) support stack canary values (also known as stack cookies or stack guards) that detect overwrites before a function returns.
Leverage ASLR and DEP: Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) make exploitation significantly more difficult by randomizing memory layouts and preventing code execution from the stack.
Adopt Memory-Safe Languages: Where possible, migrate critical components to memory-safe languages like Rust, Go, or managed languages such as Java and C#.
Validate All Input: Rigorously validate the length and content of all external inputs before they are processed or copied into stack buffers.
Ensure Proper Recursion Limits: Always define clear base cases for recursive functions and consider iterative alternatives for deeply recursive algorithms.
Use Static and Dynamic Analysis Tools: Employ static analysis tools (e.g., Coverity, CodeQL) and dynamic analysis tools (e.g., AddressSanitizer, Valgrind) to detect potential overflow conditions during development and testing.
Conduct Code Reviews and Penetration Testing: Regular security-focused code reviews and penetration testing help identify vulnerabilities before they reach production.

By implementing these layered defenses, development teams can significantly reduce the risk of stack overflow vulnerabilities and build more resilient, secure applications.

← Back to Glossary