Stack Overflow
Stack Overflow

Questions tagged [fortify-source]

FORTIFY_SOURCE is an originally GCC and GLIBC security feature that attempts to detect certain classes of buffer overflows. It's enabled by default on most Linux platforms and available for some other platforms.

FORTIFY_SOURCE is an originally GCC and GLIBC security feature that attempts to detect certain classes of buffer overflows. It's enabled by default on most Linux platforms and available for some other platforms.

When using the FORTIFY_SOURCE option, the compiler will insert code to call "safer" variants of unsafe functions if the compiler can deduce the destination buffer size. The unsafe functions include memcpy, mempcpy, memmove, memset, stpcpy, strcpy, strncpy, strcat, strncat, sprintf, snprintf, vsprintf, vsnprintf, and gets.

The option can be turned off with -D_FORTIFY_SOURCE=0 or -U_FORTIFY_SOURCE. However, its usually not appropriate to disable FORTIFY_SOURCE in production software.

Jakub Jelinek provided the GCC patch for FORTIFY_SOURCE back in 2004. The documentation for _FORTIFY_SOURCE is located in the "feature test macro(7)" man page.

Support for FORTIFY_SOURCE requires the compiler to be able to insert the calls; GCC 4.0 and Clang 2.6 are the minimum required versions. The system must also have "safer" functions available; these may be provided by glibc, by GCC's libssp, and by other libraries such as the NetBSD libc (inherited into newlib), macOS libc, and the mingw-w64 libc.

53 questions
87
votes
2 answers

difference between gcc -D_FORTIFY_SOURCE=1 and -D_FORTIFY_SOURCE=2

Can someone point out the difference between gcc -D_FORTIFY_SOURCE=1 and -D_FORTIFY_SOURCE=2? I guess =2 is more secure? I haven't been able to find a list which lists differences point by point. I have also read that -D_FORTIFY_SOURCE=2 should be…
Frank Meerkötter
  • 2,778
  • 2
  • 20
  • 26
54
votes
8 answers

Buffer overflow works in gdb but not without it

I am on CentOS 6.4 32 bit and am trying to cause a buffer overflow in a program. Within GDB it works. Here is the output: [root@localhost bufferoverflow]# gdb stack GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6_4.1) Copyright (C) 2010 Free…
thaweatherman
  • 1,467
  • 4
  • 20
  • 32
35
votes
5 answers

How can I invoke buffer overflow?

I got a homework assignment asking me to invoke a function without explicitly calling it, using buffer overflow. The code is basically this: #include #include void g() { printf("now inside g()!\n"); } void f() { …
sa125
  • 28,121
  • 38
  • 111
  • 153
31
votes
12 answers

What is a buffer overflow and how do I cause one?

I have heard about a buffer overflow and I would like to know how to cause one. Can someone show me a small buffer overflow example? New(And what they are used for?)
H4cKL0rD
  • 5,421
  • 15
  • 53
  • 74
17
votes
2 answers

Can I trick libc (GLIBC_2.13) into loading a symbol it doesn't have (from GLIBC_2.15)?

In my attempt to get "Steam for Linux" working on Debian, I've run into an issue. libcef (Chromium Embedded Framework) works fine with GLIBC_2.13 (which eglibc on Debian testing can provide), but requires one pesky little extra function from…
user824425
15
votes
7 answers

sprintf function's buffer overflow?

{ char buf[8]; sprintf(buf,"AAAA%3s","XXXXXXXX"); printf("%s\n",buf); } What will happen? The buffer has 8 characters worth of space and only 3 free characters left, however, "XXXXXXXX" is 8 characters long. I did a test with…
remainn
  • 1,125
  • 3
  • 9
  • 14
13
votes
4 answers

How to prevent memcpy buffer overflow?

There are some binary buffers with fixed sizes in a program that are used to store data, and memcpy is used to copy the buffer from one to another one. Since the source buffer may be larger than the destination buffer, how can I detect if there is…
Michael D
  • 1,449
  • 5
  • 18
  • 31
12
votes
2 answers

Causing a buffer Overflow with fgets

I'm experimenting with buffer overflows and try to overwrite the return address of the stack with a certain input of fgets This is the code: void foo() { fprintf(stderr, "You did it.\n"); } void bar() { char buf[20]; puts("Input:"); …
arnoapp
  • 2,416
  • 4
  • 38
  • 70
10
votes
1 answer

call to ‘__wmemcpy_chk_warn’: "wmemcpy called with length bigger than size of destination buffer"

I have this snippet of code (lets name it problem.cpp): #include using str = std::wstring; static str foo(str text = str()) { text.resize(4); return text; } int main() { str a = foo(); return 0; } GCC (version 12.2.1)…
srohmen
  • 223
  • 1
  • 9
10
votes
4 answers

GCC how to detect stack buffer overflow

Since there is an option -fstack-protector-strong in gcc to detect stack smashing. However, it can not always detect stack buffer overflow. For the first function func, when I input a 10 char more string, the program does not always crash. My…
Michael D
  • 1,449
  • 5
  • 18
  • 31
9
votes
4 answers

Create buffer overflows in snow leopard

As part of a course at university in computer security, I'm soon about to learn about buffer overflows and how to use them to as exploits. I'm trying to do some simple buffer overflow with the following code: #include #include…
user374275
  • 163
  • 1
  • 6
9
votes
2 answers

Disable using __sprintf_chk()

I observe that a c++ program uses sprintf, where this sprintf implicitly invokes __sprintf_chk(). This __sprintf_chk() seems to check buffer overflow by examining stack frames. For my research purpose, I wonder if it is possible to disable using…
flyingbin
  • 1,097
  • 2
  • 11
  • 28
8
votes
1 answer

Compilation fails with OpenMP on Mac OS X Lion (memcpy and SSE intrinsics)

I have stumbled upon the following problem. The below code snippet does not link on Mac OS X with any Xcode I tried (4.4, 4.5) #include #include #include int main(int argc, char *argv[]) { char *temp; #pragma…
angainor
  • 11,760
  • 2
  • 36
  • 56
7
votes
1 answer

impossible to write on stack (stack overflow)

I was experimenting some security stuff and especially trying to understand a ret2ret exploit. The code I was experimentating on : void foo(char * val){ char buffer[64]; int i; for (i=0; val[i]!=0; i++) buffer[i]=val[i]; …
user3102158
  • 173
  • 9
6
votes
1 answer

Format String Attack

I have a small C program to be exploited. And I also understood the logic behind the attack to be performed. However, as much as I try, it is just not working for me. #include #include #define SECRET1 0x44 #define SECRET2…
shambolic
  • 61
  • 1
  • 2
1
2 3 4