Question

An alternative design for a canary mechanism place the NULL value just below the return address. What is the rationale for this design decision

Answer 1

This is to prevent attacks using the strcpy() and other methods that would return while copying a null character.

Step-by-step explanation:

Canary is a mechanism used to monitor and prevent buffer overflow. The alternative canary design that places a null value just before the return address is called the terminator canary.

Though the mechanism prevents string attacks, the drawback of the technique is that the value of the canary is known which makes it easy for attackers to overwrite the canary.