1
1
# What is it?
2
2
3
3
This is a [ standalone implementation] ( https://git.2f30.org/fortify-headers/ ) of
4
- [ fortify source] ( http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html ) .
5
- It provides compile time buffer checks.
4
+ [ fortify source] ( http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html )
5
+ level 3, providing compile time security checks.
6
6
It is libc-agnostic and simply overlays the system headers by using the
7
7
[ ` #include_next ` ] ( https://gcc.gnu.org/onlinedocs/cpp/Wrapper-Headers.html )
8
8
extension found in GCC, and
@@ -11,17 +11,15 @@ on Clang. It was initially intended to be used on
11
11
[ musl] ( http://www.musl-libc.org/ ) based
12
12
[ Linux distributions] ( https://git.alpinelinux.org/aports/commit/?id=067a4f28825478911bb62be3b8da758d9722753e ) .
13
13
14
-
15
14
# Features
16
15
17
16
- It is portable, works on * BSD, Linux, Solaris and possibly others.
18
- - It will only trap non-conformant programs. This means that fortify
17
+ - It will only trap non-conformant programs. This means that fortify
19
18
level 2 is treated in the same way as level 1.
20
19
- Avoids making function calls when undefined behaviour has already been
21
- invoked. This is handled by using ` __builtin_trap() ` .
22
- - Support for out-of-bounds read interfaces, such as send(), write(),
23
- fwrite() etc.
24
- - No ABI is enforced. All of the fortify check functions are inlined
20
+ invoked. This is handled by using ` __builtin_trap() ` .
21
+ - Support for out-of-bounds read interfaces, such as send(), write(), fwrite() etc.
22
+ - No ABI is enforced. All of the fortify check functions are inlined
25
23
into the resulting binary.
26
24
- It has a [ comprehensive suite of tests] ( https://github.com/jvoisin/fortify-headers/tree/master/tests ) ,
27
25
running both on Clang and on GCC for every commit, with
@@ -48,11 +46,11 @@ main(void)
48
46
return 0;
49
47
}
50
48
EOF
51
- cc -I<path-to-fortify-include-dir> -D_FORTIFY_SOURCE=1 -O1 fgets.c
49
+ cc -I<path-to-fortify-include-dir> -D_FORTIFY_SOURCE=3 -O1 fgets.c
52
50
./a.out
53
51
```
54
52
55
- At this point, the program will safely crash.
53
+ At this point, the program will safely and loudly crash.
56
54
57
55
58
56
# Supported interfaces
0 commit comments