{"thread":{"id":"51394","subject":"[PATCH 0/1] mingw: enable GCC's stack smashing protector","startedAt":"2019-06-27T09:29:04Z","lastAt":"2019-06-27T09:29:05Z","messageCount":2,"participants":["Johannes Schindelin via GitGitGadget"],"isPatch":true,"patchVersion":1,"patchTotal":1},"messages":[{"id":"378136","messageId":"pull.215.git.gitgitgadget@gmail.com","threadId":"51394","inReplyTo":null,"subject":"[PATCH 0/1] mingw: enable GCC's stack smashing protector","fromName":"Johannes Schindelin via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2019-06-27T09:29:01Z","receivedAt":"2019-06-27T09:29:04Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Recently, I managed to upstream the Data Execution Prevention/Address Space\nLayout Randomization patches of Git for Windows. Now it is time to add to\nthat by also enabling GCC's augmenting feature which reduces the attack\nsurface even further.\n\nJohannes Schindelin (1):\n  mingw: enable stack smashing protector\n\n config.mak.uname | 3 ++-\n 1 file changed, 2 insertions(+), 1 deletion(-)\n\n\nbase-commit: aa25c82427ae70aebf3b8f970f2afd54e9a2a8c6\nPublished-As: https://github.com/gitgitgadget/git/releases/tag/pr-215%2Fdscho%2Fmingw-stack-smashing-protector-v1\nFetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-215/dscho/mingw-stack-smashing-protector-v1\nPull-Request: https://github.com/gitgitgadget/git/pull/215\n-- \ngitgitgadget\n"},{"id":"378137","messageId":"af1ac3bde430a6e7c2963e77dfb24b0eff6c587f.1561627740.git.gitgitgadget@gmail.com","threadId":"51394","inReplyTo":"pull.215.git.gitgitgadget@gmail.com","subject":"[PATCH 1/1] mingw: enable stack smashing protector","fromName":"Johannes Schindelin via GitGitGadget","fromEmail":"gitgitgadget@gmail.com","sentAt":"2019-06-27T09:29:02Z","receivedAt":"2019-06-27T09:29:05Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"From: Johannes Schindelin <johannes.schindelin@gmx.de>\n\nTo reduce Git for Windows' attack surface, we started using the Address\nSpace Layout Randomization and Data Execution Prevention features in\nce6a158561f9 (mingw: enable DEP and ASLR, 2019-05-08).\n\nTo remove yet another attack vector, let's make use of gcc's stack\nsmashing protector that helps detect stack buffer overruns early.\n\nRather than using -fstack-protector, we use -fstack-protector-strong\nbecause on Windows: The latter appears to strike a better balance\nbetween the performance impact and the provided safety.\n\nIn a non-scientific test (time git log --grep=is -p), best of 5 timings\nwent from 23.009s to 22.997s, i.e. the performance impact was *well*\nlost in the noise.\n\nThis fixes https://github.com/git-for-windows/git/issues/501\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>\n---\n config.mak.uname | 3 ++-\n 1 file changed, 2 insertions(+), 1 deletion(-)\n\ndiff --git a/config.mak.uname b/config.mak.uname\nindex b71688eeb7..2400e7879c 100644\n--- a/config.mak.uname\n+++ b/config.mak.uname\n@@ -596,7 +596,8 @@ else\n \t\t\tBASIC_LDFLAGS += -Wl,--large-address-aware\n \t\tendif\n \t\tCC = gcc\n-\t\tCOMPAT_CFLAGS += -D__USE_MINGW_ANSI_STDIO=0 -DDETECT_MSYS_TTY\n+\t\tCOMPAT_CFLAGS += -D__USE_MINGW_ANSI_STDIO=0 -DDETECT_MSYS_TTY \\\n+\t\t\t-fstack-protector-strong\n \t\tEXTLIBS += -lntdll\n \t\tINSTALL = /bin/install\n \t\tNO_R_TO_GCC_LINKER = YesPlease\n-- \ngitgitgadget\n"}]}