| 1 |
> The attached glibc patch uses the frandom sysctl interface, and has a bug fix |
| 2 |
> (/4). I removed some #ifdefs that I thought should always be defined (maybe |
| 3 |
> someone can double check it, should be okay though). |
| 4 |
|
| 5 |
a few issues: |
| 6 |
|
| 7 |
1. don't initialize __guard[] to all 0s, on some compilers it will force |
| 8 |
it into the .data section (instead of .bss), it's a slight waste... |
| 9 |
|
| 10 |
2. you have a nice buffer overflow on 64 bit archs where sizeof long = 8 |
| 11 |
but in your loop you access twice as many elements (you divide by 4 |
| 12 |
instead of sizeof long). |
| 13 |
|
| 14 |
3. for that matter, don't make __guard an array at all, i see no point in |
| 15 |
it if only the very first element is used. |
| 16 |
|
| 17 |
4. don't bother casting __guard when you fill in the terminator canary, |
| 18 |
simply: __guard[0] = 0xff000d0aUL; (or __guard = 0xff000d0aUL; ). |
| 19 |
endianess is of no concern here. you can also choose any permutation |
| 20 |
of these 4 bytes (i note that the original ssp terminator didn't contain |
| 21 |
0x0d, however stackguard's does, probably doesn't hurt). |
| 22 |
|
| 23 |
|
| 24 |
-- |
| 25 |
gentoo-hardened@g.o mailing list |
Archives