From Fedora Project Wiki
(Created page with "== Hardening detection: <code>_FORTIFY_SOURCE</code> == GCC and glibc redirect calls to function such as <code>strcpy</code> to replacements like <code>__strcpy_chk</code> an...") |
No edit summary |
||
| Line 11: | Line 11: | ||
Which alternative applies requires looking at the assembly. Presence of calls to <code>_chk</code> functions depends on optimizations, and those in turn depend on the architecture, which makes verification very difficult. | Which alternative applies requires looking at the assembly. Presence of calls to <code>_chk</code> functions depends on optimizations, and those in turn depend on the architecture, which makes verification very difficult. | ||
Addressing may need changes to both glibc and GCC. | The challenge here is that _FORTIFY_SOURCE is a preprocessor macro, and what happens behind the scenes differs from function to function. Addressing may need changes to both glibc and GCC. | ||
[[Category:Toolchain/Watermark/Provisional]] | [[Category:Toolchain/Watermark/Provisional]] | ||
Latest revision as of 10:53, 24 October 2016
Hardening detection: _FORTIFY_SOURCE
GCC and glibc redirect calls to function such as strcpy to replacements like __strcpy_chk and supply additional length information for buffer overflow checks.
Currently, strcpy is used if
- fortify is disabled,
- no length information is available, or
- the call is known to be safe.
Which alternative applies requires looking at the assembly. Presence of calls to _chk functions depends on optimizations, and those in turn depend on the architecture, which makes verification very difficult.
The challenge here is that _FORTIFY_SOURCE is a preprocessor macro, and what happens behind the scenes differs from function to function. Addressing may need changes to both glibc and GCC.