Re: iSeries buffer overflow immunity?

[Barbara Morris <bmorris@xxxxxxxxxx>]

Rich Duzenbury wrote:
> ...
> That's good news.  So, in my opinion, the likelihood that an attacker
> could hit an exact byte in RPG static storage is getting extremely low -
> The buffer has to be accessible via a pointer, unprotected by program
> code, and the storage layout from the compiler is arbitrary, so the
> important 'admin_flag' is not necessarily accessible past the end of the
> buffer.
> 

I'm can't imagine how it would be possible to make an attack through
your program even if someone did know the variable name that would get
affected by a buffer overflow.

But assuming that was possible, it just takes a bit more work to figure
out where the buffer overflow occurs.  By comparing the addresses of the
fields, you can see how storage is laid out.