Gcc‘s “-fstack-protector-strong” helped me catch an array overflow bug recently. The “-fstack-protector-strong” option will add “canary” in the function stack, when function returns, it would check whether the guard is corrupted or not. If corrupted, __stack_chk_fail() will be invoked:
0x00007ffff5138674 <+52>: mov -0x38(%rbp),%rax
0x00007ffff5138678 <+56>: xor %fs:0x28,%rax
0x00007ffff5138681 <+65>: jne 0x7ffff5138ff3 <function+2483>
......
0x00007ffff5138ff3 <+2483>: callq 0x7ffff50c2100 <__stack_chk_fail@plt>
And the program will crash:
*** stack smashing detected ***: program terminated
Segmentation fault
Use gdb to check:
(gdb) bt
#0 0x00007fffde26e0b8 in ?? () from /usr/lib64/libgcc_s.so.1
#1 0x00007fffde26efb9 in _Unwind_Backtrace () from /usr/lib64/libgcc_s.so.1
#2 0x00007fffde890aa6 in backtrace () from /usr/lib64/libc.so.6
#3 0x00007fffde7f4ef4 in __libc_message () from /usr/lib64/libc.so.6
#4 0x00007fffde894577 in __fortify_fail () from /usr/lib64/libc.so.6
#5 0x00007fffde894532 in __stack_chk_fail () from /usr/lib64/libc.so.6
#6 0x00007ffff5138ff8 in function () at src.c:685
#7 0x045b9fd4c77e2ff3 in ?? ()
#8 0x9a8ad8e7e2eb8ca8 in ?? ()
#9 0x0fa0e627193655f1 in ?? ()
#10 0xfc295178098bb96f in ?? ()
#11 0xa09a574a7780cd13 in ?? ()
......
The function frames and return addresses are overwritten, so the call stack can’t be recovered. Please be aware that the line which gdb prints:
#6 0x00007ffff5138ff8 in function () at src.c:685
may not be related to culprit!