Question

We are studying the use of the canaries to avoid buffer overflow.

There is a question that is:

Why aren’t canaries useful in this struct?

struct test {
char arra[64];
int myVar;
}

and I’m stuck on it. Any clue?

Pd. This is homework

Answer 1

I believe your professor means it will not protect (for sure) from overflow of the array within your structure. The compiler places the canary value somewhere between your structure and the end of the stack. If you overflow your array by less than int bytes, the overflow corrupts the int element of your structure, not the canary value (this is not precise because of compiler chosen structure layout). So in such cases an overflow goes undetected and could be exploited.