is there external library/approach/whatever to add
- canary protection (stack-protector equivalent)
- extra buffer boundary check (fortity source equivalent)
on a C software without using glibc / gcc built-in functionality ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Carnary protections rely on the compiler adding code before and after each function body, and possibly resorting the function's local variables, so this is not possible for item 1.
As for item 2, the only thing that does come to mind is running the executable under Valgrind for analysis. You will not want to do that in production, as it's slow. Furthermore, some GCC builtins behave badly under Valgrind (e.g. the
strlen builtin can read up to 3 bytes (on i386) past the end of an allocated buffer), so this will emit false positives.
I'd say, your only way forward is to recompile the application with SSP enabled (also, GCC ships libssp which contains functions to do item 2). Many other C libraries contain SSP supporting code (it's not much code, really) already, so not using the GNU libc is not a problem.
Some other C compilers also contain boundary checks, buffer overflow checks, stack overflow checks, etc. in various states of usability.
You should also look into your
malloc implementation. Some implementations – most notably omalloc from OpenBSD – offer reserving “guard pages” before and after page-sized allocations, and moving smaller allocations to either the beginning or end of a page, to catch accesses beyond the buffer.