Even if code can't be placed on the stack, an attacker could use a buffer overflow to make a program "return" to an existing subroutine ( such as a routine in the C library) and create an attack. 即使不能将代码放到堆栈上,攻击者也可以利用缓冲区溢出来使程序“返回”某个现有的子例程(比如C库中的某个子例程),从而进行攻击。
Imagine being able to modify the return value of your subroutine! 想象一下可以修改子程序的返回值!
Upon return from the subroutine, the system again switches back to ARM state; though this assumes that R1 is preserved by the subroutine. 从子程序返回后,系统又切换回ARM状态,虽然这个假设R1是子程序保存的。
Identification of Exception Return in Subroutine of Executable File 可执行文件中子程序异常返回的识别
The Compiling Technique of the Alternate Return in the Fortran 90 Subroutine Fortran90语言中辅程序交叉返回的编译技术