Stack smashing protection

[danielsz]

GCC stack smashing protection references:

• GCC Internals
• OSDev Wiki

When stack smashing protection is turned on, the compiler generates some fairly simple code:

extern uintptr_t __stack_chk_guard;
noreturn void __stack_chk_fail(void);

void foo(const char* str)
{
	uintptr_t canary = __stack_chk_guard;

	/* ... */

	if ( (canary = canary ^ __stack_chk_guard) != 0 )
		__stack_chk_fail();
}

It looks like all we have to do is initialize __stack_chk_guard to a random number and provide a __stack_chk_fail function which exits the program. Linux provides 16 random bytes to every process via the auxiliary vector and lone already uses those to initialize its hash functions. It should be possible to use those random bytes to initialize the stack canary as well.

Originally posted by @matheusmoreira in #3 (comment)

[matheusmoreira]

Possible implementation alternative: trapping stack smashing protector which eliminates the need to implement __stack_chk_fail. I've also requested the ability to rename these symbols.

• GCC Bugzilla
  • Bug 93509 - Stack protector should offer trap-only handling
  • Bug 113694 - Allow renaming stack smashing protector symbols
• LLVM issue tracker
  • Stack protector should have a trapping mode llvm/llvm-project#80236
  • Allow renaming stack smashing protector symbols llvm/llvm-project#80237