Re: [gentoo-hardened] ssp random bytes solution

[Robert Connolly]

On April 20, 2004 05:11 pm, pageexec@××××××××.hu wrote:
> > The attached glibc patch uses the frandom sysctl interface, and has a bug
> > fix (/4). I removed some #ifdefs that I thought should always be defined
> > (maybe someone can double check it, should be okay though).
>
> a few issues:
>
> 1. don't initialize __guard[] to all 0s, on some compilers it will force
>    it into the .data section (instead of .bss), it's a slight waste...

I have read the stack value can be used here with zero preformance loss. Just 
to set initial values.

> 2. you have a nice buffer overflow on 64 bit archs where sizeof long = 8
>    but in your loop you access twice as many elements (you divide by 4
>    instead of sizeof long).

The /4 is to prevent a bug. Only multiples of 4 and 16 can be used, its a 
double check.

> 3. for that matter, don't make __guard an array at all, i see no point in
>    it if only the very first element is used.
>
> 4. don't bother casting __guard when you fill in the terminator canary,
>    simply: __guard[0] = 0xff000d0aUL; (or __guard = 0xff000d0aUL; ).
>    endianess is of no concern here. you can also choose any permutation
>    of these 4 bytes (i note that the original ssp terminator didn't contain
>    0x0d, however stackguard's does, probably doesn't hurt).

This libc code is from Etoh & friends. I understand how it works, but not how 
to make it work in a different way.


--
gentoo-hardened@g.o mailing list