Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Stack, Heap and How Function Calls Really Work

Most programmers hear about stack and heap memory, but many don’t really get what that means until a bug bites them hard. Especially in languages like C or C++, where you are the garbage collector—understanding memory matters. A lot. …

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Most programmers hear about stack and heap memory, but many don’t really get what that means until a bug bites them hard. Especially in languages like C or C++, where you are the garbage collector—understanding memory matters. A lot.






The Memory Map You Should Know



When you run a C program, memory is usually split into these segments:




  • Code: Holds compiled instructions, i.e. your program translated to machine language.

  • Initialized Data: Some constants and literals, global variables and variables marked static inside functions.

  • Uninitialized Data: Reserved space for uninitialized global variables. This is often called 'Block Started by Symbol' (BSS), named after an old computer instruction.

  • Heap: An unordered lot of memory that is organized by the programmer using new or malloc.

  • Stack: An automatically neatly stacked pile of memory used for function calls. It holds function arguments, local variables and bookkeeping information.



Memory Segments






What Happens on a Function Call?



Let's take a simple function:




int increment(int x) {
int result = x + 1;
return result;
}






When increment(3) is called:




  • The return address is pushed to the stack (so the program knows where to come back).

  • A stack frame is created with:


    • The argument x

    • The local variable result








Stack Example




  • When the function returns, its stack frame is 'popped', and that memory is officially gone.

  • However, in practice its still there but available to be overwritten as soon as another function is called. This is what can make this problem so mysterious.



So local variables exist only as long as the function runs. They live on the stack. And that is where people run into problems.






Why This Matters – A Classic Mistake






char* create_message() {
char result[] = "Hello!";
return result;
}

void print_date() {
// ...
}

int main() {
char* message = create_message();
print_date();
printf("%s\n", message);
}






The local variable result lives on the stack. When create_message() returns, the stack frame is done. Now a pointer is returned to memory that will be used by the next function call. This is undefined behavior in C. A polite way of saying "good luck".



Stack Evolution



After calling print_date the value created in create_message() is likely overwritten by something else, often not even with the correct data type.






Want to keep the result alive?



Use the heap instead




char* create_message() {
char* result = malloc(7); // allocate memory on the heap
strncpy(result, "Hello!", 7);
return result;
}

void print_date() {
// ...
}

int main() {
char* message = create_message();
print_date();
printf("%s\n", message);
free(message); // deallocate memory on the heap
}






Using the Heap



Now the content of the message is created on the heap where it will continue to exist until it is free()ed, independent of any function calls or stack manipulations.






Takeaways




  • Stack memory is fast and automatically managed, but short-lived.

  • Heap memory is manually managed and persistent across function calls but easy to leak.

  • In non-garbage-collected languages, forgetting this distinction leads to real bugs: use-after-free, memory leaks, dangling pointers.



This kind of foundational understanding unlocks many mysteries in C, C++, Rust, and even explains why some things behave weirdly in Java or Python.






Contact



I am a university lecturer who enjoys helping developers understand how things work under the hood. If you are learning programming or struggling with C or C++, transitioning from Java, or just want to chat about memory, debugging, or low-level programming, feel free to reach out. You can contact via <my username>@mailbox.org, or leave a comment below. I am happy to offer friendly advice or tutoring. If you are looking for 1:1 help or tutoring on C/C++, systems programming, or debugging, I'm exploring offering support sessions. Reach out and we can see what works.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Stack, Heap and How Function Calls Really Work
id: fb0f00ee-5530-45ab-8c18-cf87d6d944dd
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Stack, Heap and How Function C" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Stack Heap and How Function Calls Really")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Stack Heap and How Function Calls Really*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Stack Heap and How Function Calls Really"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Stack, Heap and How Function Calls Really Work

Thematisch verwandte Begriffe: Stack, Heap, Function, Calls · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag