[PATCH 0/2] _FORTIFY_SOURCE=3

[Siddhesh Poyarekar]

This patchset implements a new fortification level, _FORTIFY_SOURCE=3.
This level allows allows more computationally expensive fortifications,
as is the case when size information is dynamic.  In this patchset it
uses the __builtin_dynamic_object_size builtin available in clang to
expand coverage of fortifications at the expense of some performance.

Patch 1/2 implements the base support and support for functions that
have builtins of string functions.  Additionally, the patch also
describes the use case and tradeoffs.

Patch 2/2 adds support for non-string functions that are already
forfified for levels 1 and 2.  These use a specific idiom that is
currently suboptimal in llvm.

Documentation                                                                                                                                                                                                      
-------------                                                                                                                                                                                                      
                                                                                                                                                                                                                   
The _FORTIFY_SOURCE documentation is not explicit about the technology                                                                                                                                             
used to implement checks and in that spirit, I have kept the                                                                                                                                                       
description for _FORTIFY_SOURCE=3 broad as well, without mentioning                                                                                                                                                
__builtin_dynamic_object_size.  Essentially, 3 is where we want to add                                                                                                                                             
computationally expensive checks and so that's the only thing that                                                                                                                                                 
gets mentioned along with the fact that it is compiler-specific.

Testing
-------

The glibc testsuite doesn't directly support clang at the moment, so
having tests in the glibc source tree is pointless as long as gcc does
not have support for __builtin_dynamic_object_size.  I will write the
tests when I work on the gcc builtin next year.

In the meantime there is a separate project on GitHub,
fortify-test-suite[1], that houses fortification tests and is capable of
testing multiple levels of fortification with multiple compilers.  I
have proposed a PR[2] to add support for _FORTIFY_SOURCE=3 and have
verified my changes with those tests.

Those tests run clean for clang when run with these changes and PR[2]
and they fail at level 3 for gcc, as expected.

[1] https://github.com/serge-sans-paille/fortify-test-suite
[2] https://github.com/serge-sans-paille/fortify-test-suite/pull/9

Siddhesh Poyarekar (2):
  string: _FORTIFY_SOURCE=3 using __builtin_dynamic_object_size
  nonstring: _FORTIFY_SOURCE=3 using __builtin_dynamic_object_size

 NEWS                            |   4 +
 include/features.h              |   6 +-
 include/string.h                |   5 +-
 io/bits/poll2.h                 |  16 ++--
 libio/bits/stdio.h              |   2 +-
 libio/bits/stdio2.h             |  53 ++++++-------
 manual/creature.texi            |   3 +-
 misc/sys/cdefs.h                |   9 +++
 posix/bits/unistd.h             | 112 ++++++++++++++-------------
 socket/bits/socket2.h           |  18 ++---
 stdlib/bits/stdlib.h            |  37 ++++-----
 string/bits/string_fortified.h  |  22 +++---
 string/bits/strings_fortified.h |   4 +-
 wcsmbs/bits/wchar2.h            | 131 ++++++++++++++++----------------
 14 files changed, 223 insertions(+), 199 deletions(-)

-- 
2.28.0