[RFC] _FORTIFY_SOURCE strictness

[Siddhesh Poyarekar]

On 07/04/2022 15:46, Andreas Schwab wrote:
> On Apr 07 2022, Siddhesh Poyarekar wrote:
> 
>> The downside of this approach is the possibility that some applications
>> don't fortify beyond level 2, insisting that their usage is safe enough.
> 
> The problem with this argument is that what is safe enough now, may be
> unsafe later due to an unrelated change elsewhere, or an attacker
> injecting some unforeseen data.  It is generally better to be safer in
> the first place, because aborting deep inside the call chain is a risk
> in itself, even if it prevented an acute undefined behaviour from doing
> bad side effects.  By checking bounds early better error recovery is
> possible in general.
> 

That's a fair point.

Thanks,
Siddhesh