Re: [PATCH] Linux: Add fortify wrapper for getdents64

[Wilco Dijkstra <Wilco dot Dijkstra at arm dot com>]

Hi Florian,

> > Do we really need to add to this broken feature? The fortify feature should have
> > been retired decades ago, it's not useful or secure at all.
> >
> > If we actually want to detect buffer overflows the correct approach is to add
> > runtime checks in GCC as that's the place where you have the right info about
> > variables and array sizes. The current implementation is completely broken
> > in that it doesn't do buffer overflow checks even in the most trivial cases, and
> > fails to inline or optimize checks. It just adds duplicate entry points which are
> > inefficient and are mostly unused... (and you get people adding ifuncs for them
> > functions just for fun)
> 
> I don't understand this.  Why do you think it does not work?  The check
> is based on GCC, and GCC passing its analysis results to glibc, so that
> GCC does not know which arguments are buffer pointers and their sizes,
> and that the actual check does not have to be inlined in the caller.

It's based on preprocessing magic, which isn't handled correctly. GCC
doesn't end up doing the right thing in most cases. What happens is that
only the most basic cases end up getting checked. Passing something
like &array[0] as an argument or a constant offset like array + 1 will not get
checked, and it cannot handle anything using a temporary even if it is set
to a fixed offset in an array immediately before it. These are all cases
compilers can trivially handle.

It may have sounded like a great idea 30 years ago when compilers were
pretty basic, but if we want secure software we need to start doing things
properly, and get rid of these hacks.
 
> Do you assume that everyone builds their applications with clang?
> That's not remotely true.  GCC is still the system compiler for us.

No that's not the issue.

Wilco