On Fri, May 31, 2024 at 10:49:47PM +0200, Borislav Petkov wrote:
> On Fri, May 31, 2024 at 01:46:37PM -0700, Kees Cook wrote:
> > Please do not do this. It still benefits from compile-time sanity
> > checking.
>
> Care to elaborate how exactly it benefits?
Because when new code gets added that accidentally does improper string
handling, fortify will yell about it at compile time. e.g, if someone
typos something like:
#define BUF_LEN_FOO 16
...
#define BUF_LEN_BAR 10
struct foo {
...
char buf[BUF_LEN_FOO];
...
};
...
void process_stuff(struct foo *p)
{
...
char local_copy[BUF_LEN_BAR];
...
strcpy(local_copy, p->buf);
...
}
or refactors and forgets to change some name, etc. It's all for catching
bugs before they happen, etc. And when source string lengths aren't
known, the runtime checking can kick in too. It happens x86 boot doesn't
have any of those (good!) so __fortify_panic() goes unused there. But
that's a larger topic covered by stuff like
CONFIG_LD_DEAD_CODE_DATA_ELIMINATION, etc.
--
Kees Cook
