Are stack overflows using memcpy possible with modern compilers?

Question

These days memcpy is protected by an interface named _memcpy_chk, which checks the size of the destination buffer at runtime. After reading the source code for _memcpy_chk at http://www.opensource.apple.com/source/Libc/Libc-825.40.1/secure/memcpy_chk.c it seems like a solid mitigation.

Are buffer overflows with memcpy simply impossible on modern computers simply impossible at this point? Should we even bother looking for them on properly compiled programs?

Answer 1

Looks like it's still possible to overflow if you try (or just make a mistake) with this example implementation of memcpy:

$ cat mc.c
#include <string.h>
#include <stdio.h>

#undef memcpy
#define bos0(dest) __builtin_object_size (dest, 0)
#define memcpy(dest, src, n) \
    __builtin___memcpy_chk (dest, src, n, bos0 (dest))

int main() {
    char baz[64];
    char bar[16];    
    char foo[16];
    char* f = foo;
    char* b = baz;
    int len = 26;

    strncpy(baz, "abcdefghijklmnopqrstuvwxyz", 26);
    memset(bar, 0, sizeof(bar));
    memcpy(f, b, len); // [a-z] is bigger than foo, will overflow into bar
    printf("Evidence of buffer overflow: %s\n", bar);
    printf("now press enter to see runtime detection working properly: \n");
    (void)getchar(); // pause for user input
    memcpy(foo, bar, len);  // buffer overflow detected at runtime
    return 0;
}
$ g++ -Wall mc.c
$ ./a.out
Evidence of buffer overflow: qrstuvwxyz
now press enter to see runtime detection working properly: 

*** buffer overflow detected ***: ./a.out terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x731af)[0x7fe0327391af]
    <snip>
Aborted
$