{"id":452,"date":"2010-12-16T18:11:27","date_gmt":"2010-12-17T02:11:27","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=452"},"modified":"2010-12-16T18:11:27","modified_gmt":"2010-12-17T02:11:27","slug":"gcc-4-5-and-d_fortify_source2-with-header-structures","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/12\/16\/gcc-4-5-and-d_fortify_source2-with-header-structures\/","title":{"rendered":"gcc-4.5 and -D_FORTIFY_SOURCE=2 with “header” structures"},"content":{"rendered":"

Recently gcc (4.5) improved its ability to see the size of various structures. As a result, the FORTIFY protections<\/a> have suddenly gotten a bit stricter. In the past, you used to be able to do things like this:<\/p>\n

\r\nstruct thingy {\r\n    int magic;\r\n    char data[4];\r\n}\r\n\r\nvoid work(char *input) {\r\n    char buffer[1000];\r\n    int length;\r\n    struct thingy *header;\r\n\r\n    header = (struct thingy *)buffer;\r\n\r\n    length = strlen(input);\r\n    if (length > sizeof(buffer) - sizeof(*header) - 1) abort();\r\n\r\n    strcpy(header->data, input);\r\n    header->magic = 42;\r\n\r\n    do_something_fun(header);\r\n}\r\n<\/pre>\n
The problem here is that gcc thinks that header->data<\/code> is only 4 bytes long. But gcc doesn’t know we intentionally overruled this (and even did length checking), so due to -D_FORTIFY_SOURCE=2<\/code>, the strcpy()<\/code> checks kick in when input<\/code> is more than 4 bytes.<\/p>\n
The fix, in this case, is to use memcpy()<\/code> instead, since we actually know how long our destination is, we can replace the strcpy(...)<\/code> line with:<\/p>\n
\r\n    memcpy(header->data, input, length + 1); \/* take 0-term too *\/\r\n<\/pre>\n
This kind of header and then data stuff is common for protocol handlers. So far, things like Wine, TFTP<\/a>, and others have been experiencing problems with the change. Please keep an eye out for it when doing testing.<\/p>\n
© 2010, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"
Recently gcc (4.5) improved its ability to see the size of various structures. As a result, the FORTIFY protections have suddenly gotten a bit stricter. In the past, you used to be able to do things like this: struct thingy { int magic; char data[4]; } void work(char *input) { char buffer[1000]; int length; struct […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/452"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=452"}],"version-history":[{"count":3,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/452\/revisions"}],"predecessor-version":[{"id":455,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/452\/revisions\/455"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}