Variable stack size

Question

My system (linux kernel 2.6.32-24) is implementing a feature named Address Space Layout Randomization (ASLR). ASLR seems to change the stack size:

void f(int n) 
{
    printf(" %d ", n);
    f(n + 1);
}

int main(...)
{
    f(0);
}

Obviously if you execute the program you'll get a stack overflow. The problem is that segmentation fault happens on different values of "n" on each execution. This is clearly caused by the ASLR (if you disable it the program exits always at the same value of "n").

I have two questions:

1. does it mean that ASLR make stack size slightly variable?
2. if so, do you see a problem in this fact? Could be a kernel bug?

Answer 1

It might mean that in one instance the stack happens to flow into some other allocated block, and in the other instance, it trips over unallocated address-space.

Answer 2

ASLR stands for "address space layout randomization". What it does is change various section/segment start addresses on each run, and yes, this includes the stack.

It's not a bug; it's by design. Its purpose, in part, is to make it harder to gain access by overflowing buffers, since in order to execute arbitrary code, you need to trick the CPU into "returning" to a certain point on the stack, or in the runtime libraries. Legitimate code would know where to return to, but some canned exploit wouldn't -- it could be a different address every time.

As for why the apparent stack size changes, stack space is allocated in pages, not bytes. Tweaking the stack pointer, especially if it's not by a multiple of the page size, changes the amount of space you see available.