Hello! On Wed, Nov 08, 2006 at 10:40:54PM +0100, I wrote: > For some time, GCC now offers the following feature: > > info Gcc > #v+ > `-fstack-protector' > Emit extra code to check for buffer overflows, such as stack > smashing attacks. This is done by adding a guard variable to > functions with vulnerable objects. This includes functions that > call alloca, and functions with buffers larger than 8 bytes. The > guards are initialized when a function is entered and then checked > when the function exits. If a guard check fails, an error message > is printed and the program exits. > #v- > > I now happen to be running a GCC 4.1 installation which has that one > enabled by default. Unfortunately, building GNU Mach and GRUB2 (didn't > check GRUB legacy) is affected by that:
To completely support this feature in kernel-like environments, work on GCC itself is needed, see <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29838>, so for the mean time I created the following patch to be able to continue building GRUB2 on systems that have `-fstack-protector' enabled by default. (This patch is equal to what we've been using in GNU Mach for some time now.) 2006-12-15 Thomas Schwinge <[EMAIL PROTECTED]> * aclocal.m4 (grub_CHECK_STACK_PROTECTOR): New definition. * configure.ac: Use it for testing the HOST and TARGET compilers. Index: aclocal.m4 =================================================================== RCS file: /cvsroot/grub/grub2/aclocal.m4,v retrieving revision 1.5 diff -u -p -r1.5 aclocal.m4 --- aclocal.m4 13 Aug 2005 18:44:14 -0000 1.5 +++ aclocal.m4 15 Dec 2006 19:18:18 -0000 @@ -343,3 +343,23 @@ dnl So use regparm 2 until a better test [Catch gcc bug]) fi ]) + +dnl Check if the C compiler supports `-fstack-protector'. +dnl Written by Thomas Schwinge. +AC_DEFUN(grub_CHECK_STACK_PROTECTOR,[ +[# Smashing stack protector. +ssp_possible=yes] +AC_MSG_CHECKING([whether `$CC' accepts `-fstack-protector']) +# Is this a reliable test case? +AC_LANG_CONFTEST([[void foo (void) { volatile char a[8]; a[3]; }]]) +[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling +# `ac_compile' like this correct, after all? +if eval "$ac_compile -S -fstack-protector -o conftest.s" 2> /dev/null; then] + AC_MSG_RESULT([yes]) + [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'? + rm -f conftest.s +else + ssp_possible=no] + AC_MSG_RESULT([no]) +[fi] +]) Index: configure.ac =================================================================== RCS file: /cvsroot/grub/grub2/configure.ac,v retrieving revision 1.35 diff -u -p -r1.35 configure.ac --- configure.ac 13 Dec 2006 22:30:19 -0000 1.35 +++ configure.ac 15 Dec 2006 19:18:18 -0000 @@ -149,6 +149,19 @@ fi AC_CHECK_FUNCS(posix_memalign memalign) # +# Compiler features. +# + +# Smashing stack protector. +grub_CHECK_STACK_PROTECTOR +[# Need that, because some distributions ship compilers that include +# `-fstack-protector' in the default specs. +if [ x"$ssp_possible" = xyes ]; then + CFLAGS=$CFLAGS\ -fno-stack-protector +fi] + + +# # Check for target programs. # @@ -225,6 +238,18 @@ if test "x$target_m32" = x1; then TARGET_LDFLAGS="$TARGET_LDFLAGS -m32" fi +# +# Compiler features. +# + +# Smashing stack protector. +grub_CHECK_STACK_PROTECTOR +[# Need that, because some distributions ship compilers that include +# `-fstack-protector' in the default specs. +if [ x"$ssp_possible" = xyes ]; then + TARGET_CFLAGS=$TARGET_CFLAGS\ -fno-stack-protector +fi] + AC_SUBST(TARGET_CFLAGS) AC_SUBST(TARGET_CPPFLAGS) AC_SUBST(TARGET_LDFLAGS) Regards, Thomas
signature.asc
Description: Digital signature
_______________________________________________ Grub-devel mailing list [email protected] http://lists.gnu.org/mailman/listinfo/grub-devel
