Detection of stack smashing [Professional Edition only]

4.2.6.12 Detection of stack smashing [Professional Edition only]

The function for detecting stack smashing is implemented by the -Xstack_protector option, -Xstack_protector_all option, or the #pragma directives described in this section.

#pragma stack_protector ( function-specification [, function-specification]... )Note

  function-specification: function-name [(num=value)]

#pragma no_stack_protector ( function-name [, function-name]... )Note

Note	The outer parentheses can be omitted.

-	Generates a code for detection of stack smashing at the entry and end of a function. A code for detection of stack smashing indicates the instructions for executing the three processes shown below.

(1) A 4-byte area is allocated just before the local variable area (in the direction towards address 0xFFFFFFFF) at the entry to a function, and the value specified by <number> is stored in the allocated area.

(2) At the end of the function, whether the 4-byte area in which <number> was stored has been rewritten is checked.

(3) If the value has been rewritten in (2), the __stack_chk_fail function is called as the stack has been smashed.

-	A decimal number from 0 to 4294967295 should be specified in <number>. If the specification of <number> is omitted, the compiler automatically specifies the number.

-	The __stack_chk_fail function needs to be defined by the user and the processing to be executed upon detection of stack smashing should be written. Note the following items when defining the __stack_chk_fail function.

-	The only possible type of return value is void and the __stack_chk_fail function does not have formal parameters.

-	Do not define the function as static.

-	It is prohibited to call the __stack_chk_fail function as a normal function.

-	The __stack_chk_fail function does not generate a code for detection of stack smashing regardless of the -Xstack_protector and -Xstack_protector_all options, and #pragma stack_protector.

-	Prevent returning to the caller, that is, the function where stack smashing was detected by taking measures such as calling abort() in the __stack_chk_fail function to terminate the program.

-	When this facility is used for a function for which PIC (see "8.6 PIC/PID Facility") is performed, PIC should also be performed for the __stack_chk_fail function.

-	A code for detection of stack smashing is not generated for a function for which #pragma no_stack_protector has been specified regardless of the -Xstack_protector option and -Xstack_protector_all option.

-	If this option is used simultaneously with #pragma stack_protector, the -Xstack_protector option, or the -Xstack_protector_all option, the specification by #pragma becomes valid.

-	#pragma stack_protector cannot be specified simultaneously with the following #pragma directives.

#pragma inline_asm, #pragma inline, #pragma stack_protector, #pragma no_stack_protector

-	#pragma no_stack_protector cannot be specified simultaneously with the following #pragma directives.

#pragma stack_protector, #pragma no_stack_protector

Example

-	<C source>

#include <stdio.h>

#include <stdlib.h>

#pragma stack_protector f1(num=1234)

void f1()   // Sample program in which the stack is smashed

    volatile char str[10];

    int i;

    for (i = 0; i <= 10; i++){

      str[i] = i; // Stack is smashed when i=10

void __stack_chk_fail(void)

    printf("stack is broken!");

    abort();

-	<Output code>

_f1:

        .stack _f1 = 16

        add 0xFFFFFFF0, r3

        movea 0x000004D2, r0, r1  ; The specified <number> 1234 is stored in the

                                  ; stack area.

        st.w r1, 0x0000000C[r3]

        mov 0x00000000, r2

        br9 .BB.LABEL.1_2

.BB.LABEL.1_1: ; bb

        movea 0x00000002, r3, r5

        add r2, r5

        st.b r2, 0x00000000[r5]

        add 0x00000001, r2

.BB.LABEL.1_2: ; bb7

        cmp 0x0000000B, r2

        blt9 .BB.LABEL.1_1

.BB.LABEL.1_3: ; return

        ld.w 0x0000000C[r3], r1   ; Data is loaded from the location where <number>

        movea 0x000004D2, r0, r12 ; was stored at the entry to a function and

        cmp r12, r1               ; it is compared with the specified num 1234.

        bnz9 .BB.LABEL.1_5        ; If they do not match, a branch occurs.

.BB.LABEL.1_4: ; return

        dispose 0x00000010, 0x00000000, [r31]

.BB.LABEL.1_5: ; return

        br9 ___stack_chk_fail     ; __stack_chk_fail is called.

___stack_chk_fail:

        .stack ___stack_chk_fail = 4

        prepare 0x00000001, 0x00000000

        mov #.STR.1, r6

        jarl _printf, r31

        jarl _abort, r31

        dispose 0x00000000, 0x00000001, [r31]