That is what I thought reading wikipedia etc. But what I am
experimenting in Linux is strange, and I would like to know how is
possible that Stack Pointer is randomized INSIDE the stack. In your
opinion (the last question because as you said I am OT), is the
following stack scheme possible?
Execution 1: |S _ _ _ a _ |
Execution 2: |_ S _ _ _ a |
where "S" is stack poninter, and "a" the array of the example.
Well, it's dependent on exactly which ALSR implementation you're
using, but no, what happens is that the whole stack is moved. In some
implementations that's just on a page basis, so the first word* on the
stack would always be at 0xXXXXXffc, with only the page - and the
surrounding allocations being randomized - IOW, the 1MB of address
space for the stack is reserved as a sequential set of 256 page frames
somewhere in the address space, and the initial stack pointed is set
to the end of that. Others allocate a large region for the stack in a
fixed location, say 8MB, and start the stack at one of roughly half a
million possible locations - basically any multiple of sixteen at
least 1MB into that reserved area. Other implementations are possible
as well.
At least one *application* that I'm aware of has implemented partial
ALSR by doing a random sized alloca() at startup, which would more or
less match what you described, but I don't know of any OS's that have
implemented it that way.
*assuming a 32 bit machine with a downward growing stack