Safe Solana Stack Smashing by OtterSec
summary
Shows a Solana compiler bug that lets safe Rust code corrupt a caller’s stack: allocating a buffer sized 0xa0001 in the callee overwrites a 4‑byte is_admin in the caller while 0xa000 does not, because the rbpf frame increment is 0xa000 and the compiler emits a warning (not an error). Reproducers include assembly listings, and short fixes are available — disable direct mapping to enable stack‑frame gaps; patched in anza v2.0.
AI-written summary · about
related talks
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
19mCounterexamples in Safe Rust
36mExploiting Buffer Overflows on RISC-V
40mFull-Stack Correctness in Wasm: Eliminating Bugs Inside and Outside the Sandbox
28mDetecting Borrow and Provenance Bugs Across Unsafe Rust [...]
22mDemostrating Binary Exploitation
36mExploiting Buffer Overflows on RISC-V
01h 00mHacking and Securing C++