FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.

» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian GCC

LinkBack Thread Tools
Old 07-07-2012, 08:47 AM
Osamu Aoki
Default Bug#680603: gcc-4.7: -fstack-protector(-all) seem to be not working as they were.

Package: gcc-4.7
Version: 4.7.1-3
Severity: normal

I was playing with -fstack-protector flag to lern this hardening thing.
There may be some regression.

Here is my toy example C code with buffer overflow.

================================================== =======
#include <stdio.h>
#include <string.h>

int main(int argc, char** argv) {
char * data = "qwertyuiopasdfghjklzxcvbnm1234567890123456789 0";
char dest[5]; /* too small */
", "Next line overflows!!!");
", "No no no ...");
return 0;
================================================== =======

I compiled with:
================================================== =======
$ gcc -g -fno-stack-protector -o bof-unsafe bof.c
$ gcc -g -fstack-protector -o bof-safe bof.c
$ gcc -g -fstack-protector-all -o bof-safest bof.c
================================================== =======

I get this as result now.

================================================== =======
$ ./bof-unsafe || echo "Error"
'Next line overflows!!!'
'No no no ...'
Segmentation fault
$ ./bof-safe || echo "Error"
'Next line overflows!!!'
'No no no ...'
Segmentation fault
$ ./bof-safest || echo "Error"
'Next line overflows!!!'
'No no no ...'
*** stack smashing detected ***: ./bof-safest terminated
Segmentation fault
================================================== =======

Before upgrading to the current version (few days ago), ./bof-safe
compiled with -fstack-protector stopped nicely with good long back trace
information right after execution of strcpy(dest,data) as expected. Now
it does not and I see 'No no no ...'.

I may be missing some utility here etc. since I am new to this
-fstack-protector thing. But what I used to see is more desirable.


-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable'), (10, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.4-trunk-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages gcc-4.7 depends on:
ii binutils 2.22-7
ii cpp-4.7 4.7.1-3
ii gcc-4.7-base 4.7.1-3
ii libc6 2.13-34
ii libgcc1 1:4.7.1-3
ii libgmp10 2:5.0.5+dfsg-2
ii libgomp1 4.7.1-3
ii libitm1 4.7.1-3
ii libmpc2 0.9-4
ii libmpfr4 3.1.0-5
ii libquadmath0 4.7.1-3
ii zlib1g 1:1.2.7.dfsg-13

Versions of packages gcc-4.7 recommends:
ii libc6-dev 2.13-34

Versions of packages gcc-4.7 suggests:
ii binutils-gold 2.22-7
pn gcc-4.7-doc <none>
ii gcc-4.7-locales 4.7.1-3
pn gcc-4.7-multilib <none>
ii libgcc1-dbg 1:4.7.1-3
ii libgomp1-dbg 4.7.1-3
ii libitm1-dbg 4.7.1-3
ii libmudflap0-4.7-dev 4.7.1-3
ii libmudflap0-dbg 4.7.1-3
ii libquadmath0-dbg 4.7.1-3

-- no debconf information

To UNSUBSCRIBE, email to debian-gcc-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20120707084712.GA8018@goofy.localdomain

Thread Tools

All times are GMT. The time now is 02:27 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org