# [PATCH 0/1] mingw: enable GCC's stack smashing protector 2 messages from 2019-06-27 to 2019-06-27. Participants: Johannes Schindelin via GitGitGadget. Thread: https://gitlist.dev/t/51394 ## Johannes Schindelin via GitGitGadget, 2019-06-27 09:29 Subject: [PATCH 0/1] mingw: enable GCC's stack smashing protector Message-ID: URL: https://gitlist.dev/e/pull.215.git.gitgitgadget%40gmail.com ``` Recently, I managed to upstream the Data Execution Prevention/Address Space Layout Randomization patches of Git for Windows. Now it is time to add to that by also enabling GCC's augmenting feature which reduces the attack surface even further. Johannes Schindelin (1): mingw: enable stack smashing protector config.mak.uname | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) base-commit: aa25c82427ae70aebf3b8f970f2afd54e9a2a8c6 Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-215%2Fdscho%2Fmingw-stack-smashing-protector-v1 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-215/dscho/mingw-stack-smashing-protector-v1 Pull-Request: https://github.com/gitgitgadget/git/pull/215 -- gitgitgadget ``` ## Johannes Schindelin via GitGitGadget, 2019-06-27 09:29 Subject: [PATCH 1/1] mingw: enable stack smashing protector Message-ID: URL: https://gitlist.dev/e/af1ac3bde430a6e7c2963e77dfb24b0eff6c587f.1561627740.git.gitgitgadget%40gmail.com In-Reply-To: ``` From: Johannes Schindelin To reduce Git for Windows' attack surface, we started using the Address Space Layout Randomization and Data Execution Prevention features in ce6a158561f9 (mingw: enable DEP and ASLR, 2019-05-08). To remove yet another attack vector, let's make use of gcc's stack smashing protector that helps detect stack buffer overruns early. Rather than using -fstack-protector, we use -fstack-protector-strong because on Windows: The latter appears to strike a better balance between the performance impact and the provided safety. In a non-scientific test (time git log --grep=is -p), best of 5 timings went from 23.009s to 22.997s, i.e. the performance impact was *well* lost in the noise. This fixes https://github.com/git-for-windows/git/issues/501 Signed-off-by: Johannes Schindelin --- config.mak.uname | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config.mak.uname b/config.mak.uname index b71688eeb7..2400e7879c 100644 --- a/config.mak.uname +++ b/config.mak.uname @@ -596,7 +596,8 @@ else BASIC_LDFLAGS += -Wl,--large-address-aware endif CC = gcc - COMPAT_CFLAGS += -D__USE_MINGW_ANSI_STDIO=0 -DDETECT_MSYS_TTY + COMPAT_CFLAGS += -D__USE_MINGW_ANSI_STDIO=0 -DDETECT_MSYS_TTY \ + -fstack-protector-strong EXTLIBS += -lntdll INSTALL = /bin/install NO_R_TO_GCC_LINKER = YesPlease -- gitgitgadget ```