Hi!
Mike Silbersack wrote:
Since the subject came up, I just tried using it, and it's not giving
me the results I expected.
But if I compile it like so:
cc -g -fstack-protector overrun.c
The overrun is not caught.
./a.out
hi>
Either I'm doing something wrong, or we have gcc misconfigured and
it's not detecting that strcpy is a function which needs to be
watched closedly.
My first guess would be that gcc knew the length of "ABCDE" and decided
it would fit in the stack buffer without overwriting anything used by
the program (because of alignment and the ideal stack layout).
But, anyway, I changed your program to strcpy() from argv instead,
hoping it would turn on ssp for overrun(). Still no protection.
# ./test AAAAAAAAAAAAAAAA
Segmentation fault: 11 (core dumped)
# gdb ./test test.core
[...]
#0 0x41414141 in ?? ()
A look at the generated code confirms it does not use ssp for overrun()
void
overrun(const char *str)
{
int x;
char a[4];
int y;
strcpy(a, str);
printf("hi");
}
# gcc -S -fstack-protector test.c
overrun:
pushl %ebp
movl %esp, %ebp
subl $24, %esp
movl 8(%ebp), %eax
movl %eax, 4(%esp)
leal -8(%ebp), %eax
movl %eax, (%esp)
call strcpy
movl $.LC1, (%esp)
call printf
leave
ret
# gcc -S -fstack-protector-all test.c
overrun:
pushl %ebp
movl %esp, %ebp
subl $40, %esp
movl 8(%ebp), %eax
movl %eax, -20(%ebp)
movl __stack_chk_guard, %eax ; put stack cookie in eax
movl %eax, -4(%ebp) ; store it on the stack
xorl %eax, %eax
movl -20(%ebp), %eax
movl %eax, 4(%esp)
leal -8(%ebp), %eax
movl %eax, (%esp)
call strcpy
movl $.LC1, (%esp)
call printf
movl -4(%ebp), %eax ; read cookie
xorl __stack_chk_guard, %eax ; if cookie is not changed,
je .L8 ; return
call __stack_chk_fail ; else abort
.L8:
leave
ret
Anyway, I don't know why gcc fail to see that overrun() needs protection.
--
Anders
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
