Re: HEADSUP: toolchain modifications required for built-in SSP

[Yaakov Selkowitz <yselkowitz at cygwin dot com>]

On 2017-11-30 02:07, Sebastian Huber wrote:
> On 30/11/17 02:43, Yaakov Selkowitz wrote:
>> Newlib/RTEMS users,
>>
>> Please be aware that, as of today's git master, and the next (2.6.0?)
>> tarball release, Newlib includes its own implementation of Stack
>> Smashing Protection (-fstack-protector*) and Object Size Checking
>> (-D_FORTIFY_SOURCE=*) features.  This implementation replaces and
>> conflicts with GCC's libssp, which is practically broken and
>> unmaintained.
>>
>> In order to avoid the conflict with GCC's libssp, Newlib/RTEMS
>> toolchains using git master or the next release MUST be rebuilt,
>> configuring with the --disable-libssp flag,
> 
> Since libssp was apparently broken, the --disable-libssp does no harm if
> used with older Newlib versions?

libssp's -fstack-protector* works fine (as long as you link with that
flag too), but -D_FORTIFY_SOURCE=* is completely broken.  Disabling it
now would prevent both.

>> and exporting
>> gcc_cv_libc_provides_ssp=yes in the environment during 'make'.
> 
> I think this should be fixed for Newlib in general in the GCC
> gcc/configure.ac:

I have attached patches for 5/6/7 and 8 (trunk) which I could propose,
but I don't know if it will get into stable versions in time, and in
trunk, it appears --disable-libssp will be enough by itself.  In the
meantime, export gcc_cv_libc_provides_ssp=yes is a workaround.

-- 
Yaakov

Attachment: gcc7-ssp-newlib.patch
Description: Text document

Attachment: gcc8-ssp-newlib.patch
Description: Text document

Attachment: signature.asc
Description: OpenPGP digital signature