Re: Xcode 3 Supports Stack Canaries
Re: Xcode 3 Supports Stack Canaries
- Subject: Re: Xcode 3 Supports Stack Canaries
- From: "Sean McBride" <email@hidden>
- Date: Tue, 4 Dec 2007 10:08:16 -0500
- Organization: Rogue Research
On 12/3/07 5:02 PM, Chris Espinosa said:
>Stack canaries, as you can see from the above, are supported in the
>gcc compiler but there's no explicit UI for them in Xcode's project
>interface or debugger. We expect that in the future, but you can still
>use the feature in Xcode 3.0 on Leopard.
>
>Session 109 at WWDC (available online to ADR members) described this
>technique,but otherwise, the only documentation is in that obscure,
>hidden place known as the man page for the compiler:
It's existence is briefly mentioned here too:
<http://developer.apple.com/releasenotes/DeveloperTools/RN-GCC4/index.html>
> -fstack-protector
> Emit extra code to check for buffer overflows, such as stack
> smashing attacks. This is done by adding a guard variable
>to
> functions with vulnerable objects. This includes
>functions that
> call alloca, and functions with buffers larger than 8
>bytes. The
> guards are initialized when a function is entered and then
>checked
> when the function exits. If a guard check fails, an error
>message
> is printed and the program exits.
>
> -fstack-protector-all
> Like -fstack-protector except that all functions are
>protected.
I did not know about the 'all' version. Is there any downside to using
it instead? I guess it would be slower, but in any noticeable way?
--
____________________________________________________________
Sean McBride, B. Eng email@hidden
Rogue Research www.rogue-research.com
Mac Software Developer Montréal, Québec, Canada
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Xcode-users mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden