Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 328507 - sys-libs/glibc include patch to improve mitigation of NUL-terminated string overflows
Summary: sys-libs/glibc include patch to improve mitigation of NUL-terminated string o...
Status: RESOLVED UPSTREAM
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Toolchain Maintainers
URL: http://sourceware.org/bugzilla/show_b...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-07-15 23:23 UTC by Magnus Granberg
Modified: 2010-08-19 23:09 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Granberg gentoo-dev 2010-07-15 23:23:10 UTC
When building the stack guard, it has been traditionally important to have the
value start (in memory) with a zero byte to protect the guard value (and the
rest of the stack past it) from being read via strcpy, etc.
This patch reduces the number of random bytes by one, leaving the leading zero byte.
https://bugs.launchpad.net/bugs/413278
Can it be included in the patchset or lest for hardened?


Reproducible: Always
Comment 1 SpanKY gentoo-dev 2010-07-16 15:53:40 UTC
NULL is a pointer, NUL is a char

"Inclusion" is a tag for the toolchain peeps to decide; please dont add it yourself

if upstream takes it, we can add it.  if not, then i dont see real value in this, so we'll skip it.