Could we harden GCC's stack smashing? (Re: Adam Zabrocki's Adventure with stack smashing protection)

[Steven Stewart-Gallus]

Thank you, I must then apologize to the GCC mailing list for bringing up
something off topic.

About GCC's _stack_chk_fail. Yeah, it's much simpler. Personally, I wouldn't
trust syslog but I'm not sure of a good alternative. I'll go bother the GLibc
people.

Thank you,
Steven Stewart-Gallus

P.S.
I'm not sure if the write to the terminal should handle EINTR. I know for pipes
that EINTR doesn't happen on Linux but I have no idea for the /dev/tty special file.

----- Original Message -----
From: Ian Lance Taylor <iant@google.com>
Date: Saturday, March 29, 2014 1:03 pm
Subject: Re: Could we harden GCC's stack smashing? (Re: Adam Zabrocki's
Adventure with stack smashing protection)
To: Steven Stewart-Gallus <sstewartgallus00@mylangara.bc.ca>
Cc: GCC Development <gcc@gcc.gnu.org>

> On Sat, Mar 29, 2014 at 10:52 AM, Steven Stewart-Gallus
> <sstewartgallus00@mylangara.bc.ca> wrote:
> >
> > Adam Zabrocki's Adventure with stack smashing protection at
> > (http://blog.pi3.com.pl/?p=485 ) is kind of interesting. It lists 
> some possible
> > weaknesses in GCC's -fstack-protector. Given that the weaknesses 
> happen when the
> > stack has already been smashed I do not think they are critical 
> but they do bug
> > me. I think that the issues happen due to the fundamental problem 
> with the
> > approach that GCC's reporting method is taking. Instead of 
> dealing with the
> > messed up state of the process it could exec a whole new process 
> or simply
> > abort. We could also actually raise our own SIGSEGV signal. I 
> coded up a small
> > illustration of how the exec strategy would work.
> 
> Thanks.  The code in question is actually part of glibc, not GCC.  All
> GCC does is call __stack_chk_fail.  You may want to take your concerns
> to the glibc developers--see http://sourceware.org/glibc.
> 
> GCC does have it's own copy of __stack_chk_fail in libssp, but it's
> simpler than the glibc version.
> 
> Ian
>