堆溢出的攻击演变与防范

Heap Overflows:Evolution of Attacks and Defenses

以栈溢出为主的缓冲区溢出研究取得了较为丰硕的成果,与其相比,堆溢出攻击要困难许多,研究力度也少了许多。然而我们绝不能低估基于堆的溢出攻击,事实上,堆溢出已经成为攻击软件的主要方式之一。论文从基本的堆溢出开始,详细研究了堆溢出的主要攻击手段及其演变,介绍了各种常见的防御措施,并且对这些研究成果进行了分析总结。最后陈述了我们对此问题的观点。

Heap overflows are more difficult to exploit than stack based overilows,and researches on it seem a Pit fewer comparing to the latter.However,we cannot underestimate the severity heap-based overflow attacks bring to computer systems,and in fact,heap overflow attacks have become one of the main methods compromising the software security.Commencing from the basic heap overflow attacks,this paper surveys all kinds of heap overflows vulnerabilities, most commonly used attacks and their evolutions.Various defense methods as well as summarizations to them are also narrated.Finally,we present our point of view on heap overflows.