Subject: propolice in libc
To: None <tech-toolchain@netbsd.org>
From: Robert Connolly <cendres@videotron.ca>
List: tech-toolchain
Date: 03/18/2004 01:25:03
Hello. I'm hoping one of you could aid me with this. I've tried a few patches 
for propolice libc functions. The freebsd and linux patches are very 
similiar. Here is the freebsd version:
https://twocents.mooo.com/new/stack_protector.c

In netbsd this fails on line 49 which is this:
+static void
+__guard_setup(void)
+{
+  int fd;
+  if (__guard[0]!=0) return;
+  fd = open ("/dev/urandom", 0);
+  if (fd != -1) {
+    ssize_t size = read (fd, (char*)&__guard, sizeof(__guard)); <-- Line 48
+    close (fd) ;
+    if (size == sizeof(__guard)) return;
+  }
+  /* If a random generator can't be used, the protector switches the guard
+     to the "terminator canary" */
+  ((char*)__guard)[0] = 0; ((char*)__guard)[1] = 0;
+  ((char*)__guard)[2] = '\n'; ((char*)__guard)[3] = 255;
+}

openbsd's patch is a bit different but fails in the same code, line 60:
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/sys/stack_protector.c

static void
__guard_setup(void)
{
        int i, mib[2];
        size_t len;

        if (__guard[0] != 0)
                return;

        mib[0] = CTL_KERN;
        mib[1] = KERN_ARND;

        len = 4;
        for (i = 0; i < sizeof(__guard) / 4; i++) {
                if (__sysctl(mib, 2, (char *)&((int *)__guard)[i], <-- Line 60
                    &len, NULL, 0) == -1)
                        break;
        }

        if (i < sizeof(__guard) / 4) {
                /* If sysctl was unsuccessful, use the "terminator canary". */
                ((char *)__guard)[0] = 0; ((char*)__guard)[1] = 0;
                ((char *)__guard)[2] = '\n'; ((char *)__guard)[3] = 255;
        }
}

stack_protector.c does not need ssp functions from gcc, and must be installed 
before gcc for this to work. Can any of you spot what's wrong with this code?