3 ms·
How is this different than any other stack canary? Is it because it is per-function instead of per-stack like Linux?
by trillic 8y ago
How is this different than any other stack canary? Is it because it is per-function instead of per-stack like Linux?
- brynet 8y agoThis uses OpenBSD's random-data memory [0][1] feature, which was used by the stack protector to provide per shared object cookies. RETGUARD is more than just an improved stack protector, as explained in the commit message it protects function epilogues that are close to return instructions. [0] https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/libexec/ld.so/SPECS.randomdata https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/lib... [1] https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
- brandmeyer 8y agoFirst off, the normal glibc/GCC stack canary is per-process, not per-stack. (I started writing a more detailed reply based on the commit description, but there was too much speculation without seeing their source code).
- brynet 8y agoOpenBSD's is per shared library, i.e: libc has a different stack cookie than your application and/or other libraries. RETGUARD however, is per function.