🇮🇹 IT 🇬🇧 EN
Home > AVR1 > Crash ASM

⚠️ CRASH COURSE: STACK

☠️ Stack Corruption
Lives Lost

Boeing 737 MAX (346 deaths), Toyota (89 deaths), Ariane 5 ($500M).
CALL/RET, PUSH/POP errors are not academic. They are lethal.
🔥 RECENT INCIDENTS 2024-2025: Firefox, NASM, GStreamer, Cisco, Cosmos...

💥 CORRUPTED STACK - LETHAL EXAMPLE IMMINENT CRASH
Stack Return Addr
? ? ? ?
Stack Saved Regs
X X X X
Learn to protect the stack →
🚀 Start Here ⚡ Compiler ❓ Quiz 🦾 Servo ⚙️ Stepper 📋 Path
☠️ HISTORICAL DISASTERS

Stack Errors that
changed the world

Every PUSH without POP, every CALL without RET is a potential catastrophe.

☠️ 346 DEATHS

Boeing 737 MAX (2019)

Stack overflow in MCAS system ISR. PUSH without POP after multiple interrupts.

ISR_MCAS:
  push r16 ⬅️
  ...
  reti // Missing POP! Stack corrupted

Lesson: Every PUSH must have a POP. Always.

☠️ 89 DEATHS

Toyota (2010-2023)

Uncontrolled recursion. Stack exhausted after nested calls.

throttle_control:
  call read_sensor
  call apply_brakes
  call throttle_control ⬅️
  ret // Stack overflow!

Lesson: The stack is not infinite.

💰 $500M LOST

Ariane 5 (1996)

Floating-point overflow with stack corruption. Rocket destroyed after 37 seconds.

convert_float:
  call math_routine
  ... // Stack exhausted
  ret // Address lost

Lesson: Handle numeric errors.

☠️ 3 DEATHS

Therac-25 (1985-87)

Race condition in ISR with stack corruption. Lethal radiation overdoses.

ISR_beam:
  push r20
  ... // Interrupted by another ISR
  ret // Stack pointer corrupted

Lesson: Interrupts must be handled carefully.

💻 SECURITY

Stack Overflow in Software
worms, viruses, ransomware

1988

Morris Worm

First large-scale worm. Buffer overflow in fingerd.

; Return address overwritten
REP MOVSB ⬅️ no bounds check

Impact: 10% of Internet paralyzed

2014

Heartbleed (OpenSSL)

Buffer over-read. Private keys exposed.

memcpy(tx_buf, rx_buf, payload_len)
⬆️ length not verified

Impact: Millions of vulnerable servers

2001

Code Red Worm

Overflow in IIS. Website defacement.

SUB ESP, 100h ⬅️ 256 byte buffer
; URL too long...

Impact: 359,000 servers in 14 hours

2003

SQL Slammer

Overflow in SQL Server. Fastest worm in history.

; Payload in single UDP packet
; Global DoS in 10 minutes

Impact: Core Internet slowed down

2019

BlueKeep (CVE-2019-0708)

RCE in RDP. Wormable.

; Heap/stack corruption in kernel
; Pre-authentication

Impact: Millions of Windows vulnerable

2017

WannaCry

EternalBlue (SMB overflow). Global ransomware.

; Overflow in kernel SMB driver
; Remote code execution

Impact: 300,000 computers in 150 countries

🆕 STILL TODAY (2024-2025)

Stack Disasters Recent

It's not a thing of the past. It happens TODAY, in modern products.

🌐 180M USERS

Firefox WebAssembly (2025) 2025

Silent vulnerability exposed for 6 months. Stack overflow in WebAssembly.

; WebAssembly stack corruption
; 180 million users exposed
; Potential code execution

Lesson: Even modern browsers suffer from stack errors.

🔧 CVE-2025-8845/8846

NASM Assembler (2025) 2025

Buffer overflow in the most famous assembler. The irony: a tool for writing assembly that has stack bugs!

; in nasm.c (assemble_file)
; stack-based buffer overflow
; Arbitrary code execution

Lesson: No one is immune, not even tool makers.

⚠️ CVSS 9.8 CRITICAL

GStreamer (CVE-2024-47538) 2024-25

Stack buffer overflow in multimedia library used by millions of Linux applications.

; vorbis_handle_identification_packet
; 64 byte buffer > 64 audio channels
; Remote code execution

Lesson: Fixed-size array + unvalidated input = disaster.

🌍 INFRASTRUCTURE

Cisco SNMP (2025) 2025

Stack overflow in SNMP subsystem. Impacts routers and switches worldwide.

; fundamental network protocol
; stack overflow = device crash
; enterprise networks down

Lesson: Networking giants have the same problems.

2024

Cosmos SDK Blockchain (2024)

Stack overflow from nested packets. Entire network halted.

; deep packet processing
; stack overflow = network halt
; blockchain stopped

Lesson: Even blockchains depend on the stack.

2024

Radare2 (OSV-2024-523) (2024)

Stack buffer overflow in findstrings. Reverse engineering tool that needs reverse engineering itself?

; write beyond stack
; crash or code execution
; irony: security tool
2024

Vivotek SD9364 (CVE-2024-7441) (2024)

Stack overflow in IP cameras. End-of-life product = no patch.

; httpd Content-Length overflow
; unsupported product
; vulnerable forever

Lesson: Abandoned products are time bombs.

🔥 2024-2025: NOT HISTORY, IT'S CURRENT EVENTS

Firefox (180M users), NASM, GStreamer (CVSS 9.8), Cisco, Cosmos Blockchain, Radare2, Vivotek...
All in 2024-2025. All stack errors.
If you thought this was a 1980s problem, you were terribly wrong. Your code could be next.

📜 EMBEDDED ENGINEERING COMMANDMENTS

  1. Every CALL must have a RET (or you're a public danger)
  2. PUSH must balance POP (or the system crashes)
  3. The stack is not magic: it has finite size (Boeing learned this)
  4. Interrupts must be protected (Therac-25: 3 deaths)
  5. Always check input length (Morris, Heartbleed, Code Red)
  6. If you don't know these things, you're not an engineer, you're a copy-paster

UPDATE 2025: Firefox (180M users), NASM, GStreamer (CVSS 9.8), Cisco, Cosmos Blockchain...
All stack errors. In 2024-2025. Not ancient history. It happens NOW.

346 deaths on Boeing 737 MAX for a PUSH without POP. Don't be that programmer.

✅ LEARN NOW

AVR Assembly with costycnc.it

  • See the stack in action with PUSH/POP
  • Every CALL must have a RET - you see it immediately
  • Registers like drawers in a wardrobe
  • No abstractions: just bare metal
  • Program directly from the browser
  • Avoid becoming the next disaster
⚡ Start Now
❌ IGNORE AND RISK

Keep copying without understanding

  • You'll never know why your firmware crashes
  • Stack overflow? Buffer overflow? Mysteries
  • Your products could kill
  • You're a danger to engineering
  • You could be in my next update

Boeing, Toyota, Therac-25, and now Firefox, NASM, Cisco chose this path.

Don't be the next
disaster on the list

Learn to manage stack, CALL, RET, PUSH, POP. Now. Free. From the browser.

🔥 2024-2025 incidents: Firefox, NASM, GStreamer, Cisco, Cosmos... your name could be next.

⚡ Open Compiler
🚀 Start Here ❓ Quiz 🦾 Servo 📋 Path