StackGuard is a mechanism for defending C programs against stack-based buffer overflows. It detects memory corruption using a canary, a known value stored in each functions stack frame immediately before the return address. Before a function returns, it verifies that its canary value hasnt changed; if it has, the program halts with a security error.

1. In some implementations, the canary value is a 64-bit integer that is randomly generated each time the program run. Why does this prevent the basic buffer-overflow attack discussed in lecture?
   2. What are the security drawbacks to choosing the canary value at compile time instead of at run time? Why do some implementations use 0 for the canary anyway?

1. 1. 3. No matter how the canary is chosen, StackGuard cannot protect against all buffer overflow vulnerabilities. Describe two kinds of bugs that can corrupt the stack and allow the adversary to take control, even with StackGuard in place.