Stack canary: how it is bypassed

The compiler inserts a random value (canary) between buffers and the return address. Before ret it checks it: if changed, it aborts. A linear overflow must cross it, so it alters it and gets detected.

The ways out

Leak: a format string or overread prints the canary; you rewrite it unchanged in the payload.

Brute-force: in processes that fork() the canary does not change across children; you guess it byte by byte (256 tries per byte).

Non-linear write: an overflow that skips the canary (arbitrary index, off-by-one on a pointer) reaches the return address without touching it.

Defence

The canary is a mitigation, not an absolute barrier: combine it with ASLR, PIE, RELRO and with removing memory bugs upstream. Prevent leaks (no format strings, no overreads).