With this technique it is possible to overwrite the return address without altering the StackGuard canary word. It is also possible to overwrite a memory area that is far from the overflowed buffer.

However, it is also possible for the compiler to optimize StackGuard performance, both for the MemGuard and Canary variants. The information regarding whether any variable has been aliased is already ...