Do canaries prevent return-into-libc and return-oriented programming attacks?
I am trying to understand if/how return-into-libc and return-oriented programming exploits are possible if a canary is being used. A canary would be placed on the stack in between the return value and the buffer to be overflown, and would need to be overwritten in order to change the return value to the location of a library function or computation. Canaries have been around since 1997 (StackGuard) and ROP is a technique first introduced in 2007 (Shacham). Does a canary make these types of attacks impossible? Does a canary make these types of attacks impossible? No, it doesn't. It makes it