From: "Tony Ingenoso" 

Its not a language problem (in the language spec sense), its an
implementation issue in the way the compilers are generating code.

THERE IS NO REQUIREMENT THAT THE STACK BE USED DURING NORMAL APPLICATION
PROGRAM OPS ON the x86 ARCHITECTURE (the hardware interrupt architecture
needs it for certain things though).  We simply have chosen to do it that
way for convenience.

The C/C++ language has NO REQUIREMENT OR NEED for a stack.  C/C++ compilers
have been implemented on a number of architectures that don't have hardware
stacks - most notably the S/370.

The S/370's implement function call/return using a register convention.
Autovars are allocated/deallocated on function entry and exit from pools.

A couple of years ago I wrote a C malloc/free replacement package that
would provide byte granular protection against overruns in any given memory
allocation.  Its not all that hard - it does cost some CPU and it does tend
to expand the page tables for a given process.

Of course, the old 80286 didn't have any of these vulnerabilities

"Geo."  wrote in message
news:403a699f$1{at}w3.nls.net...
>
> The problem is hard to detect, as popular programming languages, like C and
> C++ do not make it easy to track when programs are vulnerable to overflow.

--- BBBS/NT v4.01 Flag-5