-fstack-protector buffer overflow protection flag

[dabarych]

Hello,

My team uses the cpp_client_telemetry NDK build for Android and we would like to know what stack buffer overflow protections the service has given that we're building C++.

Specifically, does cpp_client_telemetry inherit the -fstack-protector flag from any upstream NDKs? This flag would allow for canary protection on stack buffers.

[lalitb]

@dabarych I know for sure that the default C++ SDK build script doesn't set the overflow protection flag and I don't think compiler sets it as default too. Thought it possible to override the default flags.

does cpp_client_telemetry inherit the -fstack-protector flag from any upstream NDKs

@anod Just in case you have an idea :)

Also, one way to verify would be to do a readelf/objdump on the generated library for the enabled flags.

[dabarych]

@lalitb I tried doing some readelf and objdump outputs on the .so files in the maesdk but I wasn't able to find information regarding the flags in the comment sections or elsewhere. Can you provide a pointer for where I can find this?

In addition, if the C++ SDK does not support overflow protection, could you provide reasoning as to why this is not included?

[lalitb]

In addition, if the C++ SDK does not support overflow protection, could you provide reasoning as to why this is not included?

The C++ SDK build scripts enable bare minimal flags required for building, and provide users an option to add more if desired (as suggested by @maxgolov) below. As an example, the buffer protection flag mayn't be desired for scenarios where performance is critical. So, it's ideal to let users choose such flags if required.

[lalitb]

Can you provide a pointer for where I can find this?

quick google search provides this link - https://stackoverflow.com/questions/17219252/finding-out-if-a-binary-file-has-been-compiled-with-stack-smashing-protection , haven't tried thought. Also not sure if this section is preserverd in stripped libraries :)

$ readelf -p .GCC.command.line a.out

String dump of section '.GCC.command.line':
  [     0]  -imultiarch x86_64-linux-gnu
  [    1d]  test.c
  [    24]  -mtune=generic
  [    33]  -march=x86-64
  [    41]  -frecord-gcc-switches
  [    57]  -fno-stack-protector

[maxgolov]

There's a high chance you'd be needing to explicitly add the flags your product needs in your build of SDK here:

• cpp_client_telemetry/lib/android_build/gradle.properties

  Line 21 in c480743

  # CXXFLAGS=-DHAVE_CS4=1

• cpp_client_telemetry/lib/android_build/maesdk/build.gradle

  Line 27 in c480743

  args.add("-DCMAKE_CXX_FLAGS=\"" + cxxFlag + "\"")

Or here - if you're building 1DS SDK as part of a product platform build, not as application:

• cpp_client_telemetry/Android.bp

  Line 7 in c480743

  cppflags: [

Needs/flags/requirements would differ depending on your integration scenario.