From 58aa5f45ed3282751ae118c107ff008d4df765dc Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Thu, 3 May 2012 20:42:45 -0400
Subject: overhaul SSP support to use a real canary

pthread structure has been adjusted to match the glibc/GCC abi for
where the canary is stored on i386 and x86_64. it will need variants
for other archs to provide the added security of the canary's entropy,
but even without that it still works as well as the old "minimal" ssp
support. eventually such changes will be made anyway, since they are
also needed for GCC/C11 thread-local storage support (not yet
implemented).

care is taken not to attempt initializing the thread pointer unless
the program actually uses SSP (by reference to __stack_chk_fail).
---
 src/env/__init_security.c   |  6 ++++--
 src/env/__stack_chk_fail.c  | 17 +++++++++++++----
 src/env/__stack_chk_guard.c |  2 --
 3 files changed, 17 insertions(+), 8 deletions(-)
 delete mode 100644 src/env/__stack_chk_guard.c

(limited to 'src/env')

diff --git a/src/env/__init_security.c b/src/env/__init_security.c
index 6893a252..8270f1f4 100644
--- a/src/env/__init_security.c
+++ b/src/env/__init_security.c
@@ -8,7 +8,7 @@
 
 #define AUX_CNT 24
 
-void dummy(void)
+void dummy(size_t *auxv)
 {
 }
 weak_alias(dummy, __init_ssp);
@@ -18,7 +18,9 @@ void __init_security(size_t *auxv)
 	size_t i, aux[AUX_CNT] = { 0 };
 	struct pollfd pfd[3] = { {.fd=0}, {.fd=1}, {.fd=2} };
 
-	__init_ssp();
+#ifndef SHARED
+	__init_ssp(auxv);
+#endif
 
 	for (; auxv[0]; auxv+=2) if (auxv[0]<AUX_CNT) aux[auxv[0]] = auxv[1];
 	if (aux[AT_UID]==aux[AT_EUID] && aux[AT_GID]==aux[AT_EGID]
diff --git a/src/env/__stack_chk_fail.c b/src/env/__stack_chk_fail.c
index bbba3511..c6d0feb9 100644
--- a/src/env/__stack_chk_fail.c
+++ b/src/env/__stack_chk_fail.c
@@ -1,11 +1,20 @@
+#include <string.h>
+#include <inttypes.h>
+#include <elf.h>
 #include "pthread_impl.h"
 #include "atomic.h"
 
-void __init_ssp(void)
+uintptr_t __stack_chk_guard;
+
+void __init_ssp(size_t *auxv)
 {
-#ifndef __PIC__
-	__pthread_self_init();
-#endif
+	size_t i;
+	pthread_t self = __pthread_self_init();
+	uintptr_t canary;
+	for (i=0; auxv[i] && auxv[i]!=AT_RANDOM; i+=2);
+	if (auxv[i]) memcpy(&canary, (void *)auxv[i+1], sizeof canary);
+	else canary = (uintptr_t)&canary * 1103515245;
+	__stack_chk_guard = self->canary = canary;
 }
 
 void __stack_chk_fail(void)
diff --git a/src/env/__stack_chk_guard.c b/src/env/__stack_chk_guard.c
deleted file mode 100644
index f4c9e4f5..00000000
--- a/src/env/__stack_chk_guard.c
+++ /dev/null
@@ -1,2 +0,0 @@
-#include <inttypes.h>
-uintptr_t __stack_chk_guard = 0xdecafbad;
-- 
cgit v1.2.1