lone-lang / lone

The standalone Linux Lisp
GNU Affero General Public License v3.0
307 stars 8 forks source link

Stack smashing protection #4

Open danielsz opened 10 months ago

danielsz commented 10 months ago

GCC stack smashing protection references:

When stack smashing protection is turned on, the compiler generates some fairly simple code:

extern uintptr_t __stack_chk_guard;
noreturn void __stack_chk_fail(void);

void foo(const char* str)
{
    uintptr_t canary = __stack_chk_guard;

    /* ... */

    if ( (canary = canary ^ __stack_chk_guard) != 0 )
        __stack_chk_fail();
}

It looks like all we have to do is initialize __stack_chk_guard to a random number and provide a __stack_chk_fail function which exits the program. Linux provides 16 random bytes to every process via the auxiliary vector and lone already uses those to initialize its hash functions. It should be possible to use those random bytes to initialize the stack canary as well.

Originally posted by @matheusmoreira in https://github.com/lone-lang/lone/issues/3#issuecomment-1916786898

matheusmoreira commented 10 months ago

Possible implementation alternative: trapping stack smashing protector which eliminates the need to implement __stack_chk_fail. I've also requested the ability to rename these symbols.