pointers - C - Buffer on heap not lost after EXEC but saved on stack -

i studying stack buffer overflows , saw made me think. first of operating system damn vulnerable linux kernel 2.6.20 , aslr disabled.

the fact knew when call exec function inside c program, memory in heap , stack zeroed , lost. if allocate buffer in heap (malloc) , pass pointer buffer argument program executed exec function, data inside buffer (in heap) saved on stack. @ end of exec have buffer (that in heap before) in stack. in order make clearer here's example:

program: bingo  #include <stdlib.h>  int main(int argc,char* argv[]){     int i;     char *buffer=malloc(600);     (i=0;i<600;i++){          buffer[i]='a';     }     buffer[600-1]=0;     execl("./test","test",buffer,0);      free(buffer);     return 0; } 

and test simple program.

program: test  #include <stdlib.h>  int main(int argc,char* argv[]){     printf("hello world\n");              return 0; } 

now if debug bingo program gdb can see content of buffer (all as) put in heap copied on stack during execl function. @ end of execution of program heap zeroed content of buffer has been copied on stack. explanation happens because way content of buffer made available executed program (test). i'd know if behaviour normal. doubt was: when call execl function pass pointer argument executed program (test). 'cause buffer pointer. (probably stupid) question is: shouldn't pointer passed executed program , not content pointed pointer?

thank you

the reason buffer copied stack is being passed parameter, argv[1] in ./test. buffer variable references memory location in bingo. heap allocations not persist when process exits.

note: suppose buffer references 0xfff123 in memory of bingo process. virtual (process-specific) address. 0xffff123 may not mapped ./test. passing pointer 0xfff123 not guaranteed think.

after execl called successfully, bingo exits @ point, , memory associated process lost, , free(buffer) never executes.

answer: no. process heap allocation not persist across processes. shared memory objects kernel persistent, results of malloc invocation not.

i'm not sure of confusion lies, best guess.

relative addressing example:

processes have 0x00000000 (on 32 bit) address. if kernel mapped every process same physical address, each process share 0x0000000 cannot physically happen. kernel changes virtual address (the 0x0000000 ) real physical address 0x3535fffa. pointer in process "aimed at" 0x00000000 virtual 0x3535fffa.

what means cannot directly pass heap pointers between processes. won't work. pointer 0x3535fffa different physical address 0x3535fffa used reference.

execl copying aaaaa's new buffer inside ./test memory, saw.