about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--src/env/__stack_chk_fail.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/env/__stack_chk_fail.c b/src/env/__stack_chk_fail.c
index bf5a280a..e5352602 100644
--- a/src/env/__stack_chk_fail.c
+++ b/src/env/__stack_chk_fail.c
@@ -9,6 +9,15 @@ void __init_ssp(void *entropy)
 	if (entropy) memcpy(&__stack_chk_guard, entropy, sizeof(uintptr_t));
 	else __stack_chk_guard = (uintptr_t)&__stack_chk_guard * 1103515245;
 
+#if UINTPTR_MAX >= 0xffffffffffffffff
+	/* Sacrifice 8 bits of entropy on 64bit to prevent leaking/
+	 * overwriting the canary via string-manipulation functions.
+	 * The NULL byte is on the second byte so that off-by-ones can
+	 * still be detected. Endianness is taken care of
+	 * automatically. */
+	((char *)&__stack_chk_guard)[1] = 0;
+#endif
+
 	__pthread_self()->canary = __stack_chk_guard;
 }