Cybersecurity glossary
What is a Stack Buffer Overflow?
Learn what a stack buffer overflow is, how overwriting stack frames can hijack return addresses, how modern mitigations raise exploit cost, and how to prevent stack-based overflows in native code.
Definition
A stack buffer overflow is a buffer overflow that occurs in a stack-allocated buffer, allowing excess data to overwrite adjacent stack memory such as saved registers, security cookies, or return addresses and potentially redirect program control flow.
Why stack buffer overflows matter
The call stack is not just storage for local variables—it also stores how a function returns. When a local buffer overflows, attacker data can rewrite that return path.
Stack Buffer Overflow (also called stack smashing) is the classic path from an unchecked strcpy into hijacked control flow. Modern OS and compiler mitigations raised the bar, but the underlying coding mistake still produces crashes and, in some environments, reliable exploits.
How stack overflow exploitation works
Place a buffer on the stack
A function allocates a local array for a packet, path, password, or decoded field.
Write past the array end
An unbounded copy or wrong length calculation continues into adjacent stack bytes.
Overwrite frame control data
Saved registers, canaries, or the return address receive attacker-controlled values.
Function returns
The CPU pops a forged return address and continues at an attacker-chosen location.
Bypass mitigations if needed
ROP, info leaks, or partial overwrites may be required against ASLR, NX, and canaries.
Stack overflow patterns to watch
Fixed-size local arrays
char buf[256] filled from a network or file length the code never verifies.
Varargs formatting into stack buffers
sprintf/vsprintf writing unbounded formatted output into a local buffer.
Recursive or deep parsers
Deep nesting plus large locals increases stack pressure and overflow likelihood.
Embedded and RTOS targets
Small stacks and limited mitigations make overflows especially dangerous.
Defenses and what they buy you
| Control | Notes |
|---|---|
| Size-aware copies | Use bounded APIs; pass destination capacity explicitly; reject oversized inputs |
| Stack canaries | Detect many return-path overwrites before returning; enable in all builds |
| ASLR + NX/DEP | Raise exploit cost; still require correct bounds checks |
| Safe stack / CFI | Hardening options that make control-flow hijacks harder on supported platforms |
| Memory-safe languages | Remove most stack overflow classes for new components |
| Fuzz local parsers | Crash on malformed input often indicates reachable stack corruption |
- Find every local array that receives untrusted or length-prefixed data.
- Eliminate strcpy/sprintf/gets-style APIs in favor of bounded alternatives.
- Enable stack protectors and fortify options for release and debug builds.
- Confirm ASLR and NX are active on deployment platforms.
- Fuzz protocol and file parsers that use stack buffers.
- Keep stack usage modest in embedded code; prefer heap or streaming parsers when sizes vary.
- Treat stack smashing reports from canaries as security defects, not noise.
- Migrate high-risk parsers to memory-safe languages when feasible.
The practical takeaway
A stack buffer overflow rewrites the call stack—often including the return address—by writing past a local buffer. Mitigations make exploits harder; correct bounds checking and safer languages remove the bug.
If you still ship C functions that copy untrusted data into char buf[N], audit those call sites first.
Related security terms
Buffer Overflow
Parent vulnerability class covering any write past a buffer’s capacity.
Heap Overflow
Overflow into heap objects or allocator metadata instead of the stack.
Out-of-Bounds Write
General write outside object bounds, of which stack overflows are a subtype.
Memory Corruption
Broader family of flaws that break memory integrity and control flow.
Frequently asked questions
What is a stack buffer overflow in simple terms?
A function stores data in a temporary stack buffer. If more data is written than fits, it can overwrite the function’s return address so that when the function finishes, execution jumps somewhere the attacker chose.
How is this different from a heap overflow?
Stack overflows corrupt the call stack (frames, return addresses). Heap overflows corrupt dynamically allocated objects or heap manager metadata. Both are buffer overflows with different layouts and exploit paths.
What is stack smashing?
An informal name for attacking stack buffers to overwrite control data—especially return addresses—sometimes detected by stack-smashing protectors (canaries).
Do stack canaries stop all stack overflows?
Canaries detect many overwrites of the return path before a function returns, but they do not fix the bug. Partial overwrites, information leaks, and non-return control data may still be abusable.
Does NX/DEP make stack overflows harmless?
NX stops executing injected shellcode on the stack, but attackers can still use return-oriented programming (ROP) with existing executable code. Bounds checking remains essential.
Where do stack overflows still appear?
Legacy C network services, embedded firmware, protocol parsers, and native libraries that copy attacker-controlled strings into local arrays.
What is the primary fix?
Never copy more bytes than the destination holds. Use size-aware APIs, validate lengths, enable stack protectors, and prefer memory-safe languages for new parsers.
References
Explore authoritative guidance and frameworks related to stack buffer overflow.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.