How to declare variables in asm x86?

Question

Here's the code snippet:

int main() { char buffer[64]; int check; ... 

As you can see, check declared AFTER buffer , so on the stack we should have check ABOVE buffer on the stack, right?

However, when I parse (x86) it using gdb, this is what I got:

-> check at 0xbffff4f8

-> buffer at 0xbffff4b8

My question is: is there a specific stack order for a local variable?

Also, I have to tell you that I tried the same thing on another computer (x86 too, the same gcc compilation options, but a different version of gdb and the linux distribution), and the order is not the same ...: S

Thanks!

PS: if you want to get more detailed information, see the screenshot: (on the left with computer 1 and on the right with computer 2)

Answer 1

-fstack-protect has -fstack-protect to reorder the stack variables enabled by default in some versions of Linux for almost 10 years, especially Ubuntu, Redhat, gentoo. Also by default since gcc 4.8.3 ("4.9 and later versions include -fstack-protector-strong.")

Ubuntu page about gcc defaults: https://wiki.ubuntu.com/ToolChain/CompilerFlags

Ubuntu-defined default compiler flags in the -fstack-protector used to provide additional security features for Ubuntu .... The default -fstack-protector ... First included in Ubuntu 6.10.

Ubuntu stack protection page https://wiki.ubuntu.com/GccSsp

gcc 4.1 now ships with SSP, which is a good technology to reduce the operational reliability of multiple buffer overflows .... SSP provides technology to stop using this class of vulnerabilities by (1) reordering stack variables ... RedHat and gentoo use SSP by default in over the years

This reordering requires several O(n^2) moves for all local function variables that slow down compilation for long functions, for example, "Why does compiling more than 100,000 lines of std :: vector :: push_back take a lot of time?" - fooobar.com/questions/274377 / ...

Deferred distribution is forced when -fstack-protect enabled (sometimes it needs to change the order of all the stack variables) ... cfgexpand.c

 969 /* A subroutine of expand_one_var. VAR is a variable that will be 970 allocated to the local stack frame. Return true if we wish to 971 add VAR to STACK_VARS so that it will be coalesced with other 972 variables. Return false to allocate VAR immediately. 973 974 This function is used to reduce the number of variables considered 975 for coalescing, which reduces the size of the quadratic problem. */ 976 977 static bool 978 defer_stack_allocation (tree var, bool toplevel) 980 /* If stack protection is enabled, *all* stack variables must be deferred, 981 so that we can re-order the strings to the top of the frame. */ 

So gcc will reorder all the variables in the stack, and the lines will be at the top of the frame. Try -fno-stack-protector disable.

As usual, the gcc author does not document how -fstack-protect works in the public documentation https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html :

-fstack-protector Extract additional code to check for buffer overflows, such as packet-based attacks. This is done by adding a security variable to functions with vulnerable objects. This includes functions that call alloca and functions with buffers larger than 8 bytes. Guards are initialized when a function is entered, and then checked when the function exits. If the security check fails, an error message is displayed and the program exits the system.

-fstack-protector-all Like -fstack-protector , except that all functions are protected.

-fstack-protector-strong Like -fstack-protector , but it includes additional security features — those that have local array definitions or that have links to local frame addresses.

-fstack-protector-explicit Like -fstack-protector , but protects only those functions that have the stack_protect attribute.

And the only documentation on arrays in front of the locales that I see is the real, best documentation: the source code

https://gcc.gnu.org/viewcvs/gcc/branches/gcc-4_6-branch/gcc/cfgexpand.c?revision=175029&view=markup#l1526 - expand_used_vars()

 1533 if (has_protected_decls) 1534 { 1535 /* Phase 1 contains only character arrays. */ 1536 expand_stack_vars (stack_protect_decl_phase_1); 1537 1538 /* Phase 2 contains other kinds of arrays. */ 1539 if (flag_stack_protect == 2) 1540 expand_stack_vars (stack_protect_decl_phase_2); 1541 } 1542 1543 expand_stack_vars (NULL); 

phase 1 and phase 2 are separated by the symbol stack_protect_decl_phase() https://gcc.gnu.org/viewcvs/gcc/branches/gcc-4_6-branch/gcc/cfgexpand.c?revision=175029&view=markup#l1235

 1235 /* Return nonzero if DECL should be segregated into the "vulnerable" upper 1236 part of the local stack frame. Remember if we ever return nonzero for 1237 any variable in this function. The return value is the phase number in 1238 which the variable should be allocated. */ 1239 1240 static int 1241 stack_protect_decl_phase (tree decl) ... 1243 unsigned int bits = stack_protect_classify_type (TREE_TYPE (decl)); ... 1249 if (flag_stack_protect == 2) 1250 { 1251 if ((bits & (SPCT_HAS_SMALL_CHAR_ARRAY | SPCT_HAS_LARGE_CHAR_ARRAY)) 1252 && !(bits & SPCT_HAS_AGGREGATE)) 1253 ret = 1; 1254 else if (bits & SPCT_HAS_ARRAY) 1255 ret = 2; 1256 } 

stack_protect_classify_type will return HAS_ARRAY bits with HAS_*_CHAR_ARRAY only for char arrays (both char, unsigned char and signed char )