Patent ID: 8196110

Claim:
A computer implemented method for verifying a return address, the method comprising: a) storing the return address into a stack based on a function call; b) generating a first hash based on a first stack frame and a second stack frame; c) storing the first hash in a first canary location, wherein the first canary location is in the first stack frame; d) executing at least one instruction of a routine referenced by the function call; e) reading the first canary location to form a first suspect hash; f) calculating a first verification hash based on the first stack frame and the second stack frame; g) determining that the first verification hash matches the first suspect hash to form a first positive determination; h) responsive to the first positive determination, reading a second canary location to form a second suspect hash; i) calculating a second verification hash based on the second stack frame; j) determining that the second verification hash matches the second suspect hash to form a second positive determination; k) responsive to the first positive determination and the second positive determination, popping the return address off the stack; and l) executing at least one instruction at a memory location pointed to by the return address.