Secure Coding in C and C++

Chapter 3Pointer Subterfuge

with Rob Murawski¹

1. Robert Murawski is a member of the technical staff for the SEI’s Networked Systems Survivability Program.

So saying, her rash hand in evil hourForth-reaching to the Fruit, she plucked, she eat.Earth felt the wound, and Nature from her seat,Sighing through all her works, gave signs of woeThat all was lost.—John Milton, Paradise Lost (Book IX, lines 780-784)

Pointer subterfuge is a general term for exploits that modify a pointer’s value [Pincus 04]. A pointer is a variable that contains the address of a function, array element, or other data structure. For our purposes, it is only necessary to distinguish between function pointers and data pointers.

Function pointers can be overwritten to transfer ...