本文的目的是读完本文及参考文献后基本理解什么是栈,C语言函数调用过程中栈的变化,以及缓冲区溢出原理。
基本知识
- Stack(栈) is a container of objects that are inserted and removed according to the last-in first-out (LIFO) principle. In the pushdown stacks only two operations are allowed: push the item into the stack, and pop the item out of the stack. A stack is a limited access data structure - elements can be added and removed from the stack only at the top. push adds an item to the top of the stack, pop removes the item from the top [1].
- Stack Frame(栈帧) is the collection of all data on the stack associated with one subprogram call. The stack frame generally includes: the return address, the argument variables passed on the stack, local variables and the saved copies of any registers modified by the subprogram that need to be restored [2].
- EBP(帧指针) is the base pointer for the current stack frame [3].
- ESP(栈指针) is the current stack pointer [3].
- 每次调用函数时,生成一个新的栈帧,存放于栈的某段空间中。EBP总是指向栈帧的顶部(高地址),而ESP指向栈中的下一个可用字节。EBP在函数执行期间不发生变化,而ESP随着函数执行是变化的[3]。
函数调用过程中栈的变化
请参考以下两篇文献:
- 函数调用过程(ebp, esp), 注意文中个别地方有错误。
- windows进程中的内存结构,该部分内容位在整篇博文的中间,可以Ctrl+f搜索“windows进程中的内存结构”。
缓冲区溢出原理
请参考以下两篇文献:
其它参考文献:
[1] Stacks and Queues
[2] The Stack Frame
[3] What is between ESP and EBP?