Get the latest tech news

GCC's new fortification level: The gains and costs (2022)


Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows,

The improved fortification also encountered issues in the GNU C library (glibc) and raised interesting questions about object lifetimes. To further support the use of_FORTIFY_SOURCE=3 to improve fortification, we used the Fortify metrics GCC plugin to estimate the number of times _FORTIFY_SOURCE=3 resulted in a call to a checking function (__memcpy_chk,__memset_chk, etc.). In the AutoGen example, a simple fix is to unconditionally refresh the pointer after reallocation, ensuring the compiler can detect the new object size.

Get the Android app

Or read this on Hacker News

Read more on:

Photo of costs

costs

Photo of gains

gains

Photo of gcc

gcc

Related news:

News photo

Mandiant Founder Aims to Impose Costs on Hackers in VC Role

News photo

GCC 15 Adds NVIDIA Grace CPU Support With "-mcpu=grace" Option

News photo

How GCC and Clang handle statically known undefined behaviour