Glossary
Structured Exception Handling (SEH)
Windows' exception-handling mechanism; on 32-bit x86 it is a linked list of handler records on the stack, which a stack overflow can overwrite to hijack control.
Structured Exception Handling (SEH) is the Windows mechanism for handling exceptions such as access violations. On 32-bit x86 it is implemented as a linked list of records stored on the stack, each holding a pointer to the next record and a pointer to a handler function. When an exception occurs, the dispatcher walks the chain calling handlers.
Because the records live on the stack, a stack overflow can overwrite one. The classic SEH overwrite sets the handler to a pop pop ret gadget and the next-record field to a short jump, so the dispatcher lands execution in attacker shellcode. SafeSEH (a compile-time handler table) and SEHOP (a runtime chain check) defeat it. See SEH overwrites.