Bug 21746 - __stack_chk_fail should keep stack usage to minimal
Summary: __stack_chk_fail should keep stack usage to minimal
Status: RESOLVED DUPLICATE of bug 12189
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.26
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-10 16:56 UTC by H.J. Lu
Modified: 2017-07-12 08:21 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description H.J. Lu 2017-07-10 16:56:48 UTC
After stack is compromised, stack unwinding becomes unreliable:

[hjl@gnu-6 tmp]$ cat ssp-1.c
int main (void)
{
  int i = 0;
  char foo[255];

  /* Overflow buffer.  */
  for (i = 0; i < 400; i++)
    foo[i] = 42;

  return 1; /* fail */
}
[hjl@gnu-6 tmp]$ gcc  ssp-1.c -g -fstack-protector 
[hjl@gnu-6 tmp]$ ./a.out 
*** stack smashing detected ***: ./a.out terminated
Segmentation fault
[hjl@gnu-6 tmp]$ gdb a.out 
GNU gdb (GDB) Fedora 8.0-13.0.fc25
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from a.out...done.
(gdb) r
Starting program: /tmp/a.out 
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.24-9.0.fc25.x86_64
*** stack smashing detected ***: /tmp/a.out terminated

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7806c8b in ?? () from /lib64/libgcc_s.so.1
Missing separate debuginfos, use: dnf debuginfo-install libgcc-6.3.1-3.2.fc25.x86_64
(gdb) bt
#0  0x00007ffff7806c8b in ?? () from /lib64/libgcc_s.so.1
#1  0x00007ffff7808628 in _Unwind_Backtrace () from /lib64/libgcc_s.so.1
#2  0x00007ffff7b26b8f in backtrace () from /lib64/libc.so.6
#3  0x00007ffff7a2efb6 in backtrace_and_maps () from /lib64/libc.so.6
#4  0x00007ffff7a886eb in __libc_message () from /lib64/libc.so.6
#5  0x00007ffff7b2a387 in __fortify_fail () from /lib64/libc.so.6
#6  0x00007ffff7b2a350 in __stack_chk_fail () from /lib64/libc.so.6
#7  0x0000000000400592 in main () at ssp-1.c:11
(gdb)
Comment 1 H.J. Lu 2017-07-10 16:58:40 UTC
Dup.

*** This bug has been marked as a duplicate of bug 12189 ***