Can one prevent stack overflow by storing strings in memory backwards?

Question

Normal use:

 ------(buffer)------ --(ret)--- DDDDDDDDEEEEEEEEEEEE EEEE FFFF 89ABCDEF0123456789AB CDEF 0123 this is a string\0 bff5 a400 

Stack overflowed:

 ------(buffer)------ --(ret)--- DDDDDDDDEEEEEEEEEEEE EEEE FFFF 89ABCDEF0123456789AB CDEF 0123 oh no you got hacked cadf aff0 \0 

Could you prevent this by putting the initial value of the string in the last (or, if there are other variables, closest to last) memory slot (EB) and making each subsequent letter each previous slot? E.g.

 ------(buffer)------ --(ret)--- DDDDDDDDEEEEEEEEEEEE EEEE FFFF 89ABCDEF0123456789AB CDEF 0123 dekcah tog uoy on ho bff5 a400 (no harm to ret pointer) 

I understand there are better and more widely-accepted stack overflow preempts (canaries, noexec, ASLR). I'm just wondering. Would this fix the problem? Would it be technically feasible?

Answer 1

If your code doesn't protect from writing into adjacent memory spaces, then no you can't reverse the order and be protected from a buffer overflow. Reversing the way the string is stored just changes the shellcode payload arrangement (i.e. the payload may come first and the NOPS [x\00] may go in last). Like this:

x\DEx\ADx\BEx\EF\x00x\00x\00

vs

x\00x\00x\00x\DEx\ADx\BEx\EF

As you mentioned, there are much better coding practices that protect against buffer overflows.

Answer 2

It would probably stop some attacks that rely on exploiting strcpy and the like (when copying stuff around on the stack) because if you write into the opposite direction of the return address on the stack you at least can't overwrite that directly. It would still allow you to overwrite other things on the stack - possibly pointers - among many other things. It also wont protect against memcpy and many other things. Stack cannaries work pretty much against every buffer overflow. Stack cannaries however do not prevent an attacker from overwriting other pointers on the stack. Meaning you can still control pointers on the stack and use these pointers and other things in the code to write to arbitrary memory locations including the return address on the stack.