0

is there external library/approach/whatever to add

  1. canary protection (stack-protector equivalent)
  2. extra buffer boundary check (fortity source equivalent)

on a C software without using glibc / gcc built-in functionality ?

  • 1
    What requirements do you have that aren't satisfied by the built-in functionality? – Polynomial May 26 '14 at 23:32
  • There isn't nothing wrong with the built-in functionality, my constraint is that I can't link the glibc. – boos May 27 '14 at 10:13
  • 1
    Surely those features aren't reliant on linking a library? I was under the impression that they're features of the compiler rather than features of libc. – Polynomial May 27 '14 at 10:47
  • No, compiler add pre/post function check on the code for canary etc, but the functional code for the canary check or fail are in the libc. They are respectively __stack_chk_guard/__stack_chk_fail . – boos May 27 '14 at 12:05
2

Carnary protections rely on the compiler adding code before and after each function body, and possibly resorting the function's local variables, so this is not possible for item 1.

As for item 2, the only thing that does come to mind is running the executable under Valgrind for analysis. You will not want to do that in production, as it's slow. Furthermore, some GCC builtins behave badly under Valgrind (e.g. the strlen builtin can read up to 3 bytes (on i386) past the end of an allocated buffer), so this will emit false positives.

I'd say, your only way forward is to recompile the application with SSP enabled (also, GCC ships libssp which contains functions to do item 2). Many other C libraries contain SSP supporting code (it's not much code, really) already, so not using the GNU libc is not a problem.

Some other C compilers also contain boundary checks, buffer overflow checks, stack overflow checks, etc. in various states of usability.

You should also look into your malloc implementation. Some implementations – most notably omalloc from OpenBSD – offer reserving “guard pages” before and after page-sized allocations, and moving smaller allocations to either the beginning or end of a page, to catch accesses beyond the buffer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.