This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug other/77409] CVE-2016-4973 Targets using libssp for SSP are missing -D_FORTIFY_SOURCE functionality
- From: "pinskia at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Tue, 30 Aug 2016 02:08:11 +0000
- Subject: [Bug other/77409] CVE-2016-4973 Targets using libssp for SSP are missing -D_FORTIFY_SOURCE functionality
- Auto-submitted: auto-generated
- References: <bug-77409-4@http.gcc.gnu.org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77409
--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
> The entire point of libssp is to provide this support on systems whose libc
> does not include it, so that both -D_FORTIFY_SOURCE and -fstack-protector*
> functionality would be available cross-platform.
Yes if you used the right headers and the right options. You need to include
the correct headers for those applications. Use the option as Jakub mentioned
in the redhat bug report and you get the behavior you want. This is not
designed to be included behind someone's back which is what you want.