Buffer overflow protection: Difference between revisions

Revision as of 14:24, 27 February 2023

Revision as of 04:00, 3 March 2023

Line 75:

===Clang/[[LLVM]]===

Clang supports the same <kbd>-fstack-protector</kbd> options as GCC,<ref>{{cite web|url=https://lists.llvm.org/pipermail/cfe-dev/2017-April/053662.html |publisher=Clang.llvm.org |title=Clang mailing list |access-date=2022-11-16}}</ref> plusa low overhead "safe stack" ({{tt|-fsanitize=safe-stack}}) system that splits unsafe stack variables from safe ones.<ref>{{cite web |title=SafeStack — Clang 17.0.0git documentation |url=https://clang.llvm.org/docs/SafeStack.html |website=clang.llvm.org}}</ref> Clang also has three buffer overflow detectors, namely

[[AddressSanitizer]] (-fsanitize=address),<ref name="asan"/> UBSan (-fsanitize=bounds),<ref>{{cite web|url=http://clang.llvm.org/docs/UsersManual.html |title=Clang Compiler User's Manual — Clang 3.5 documentation |publisher=Clang.llvm.org |access-date=2014-04-27}}</ref>

-fsanitize=bounds,and the unofficial SafeCode (last updated for LLVM 3.0).<ref>{{cite web|url=http://clangsafecode.llvmcs.org/docs/UsersManualillinois.htmledu/ |title=Clang Compiler User's Manual — Clang 3.5 documentationSAFECode |publisher=ClangSafecode.cs.llvmillinois.orgedu |access-date=2014-04-27}}</ref>

and SafeCode.<ref>{{cite web|url=http://safecode.cs.illinois.edu/ |title=SAFECode |publisher=Safecode.cs.illinois.edu |access-date=2014-04-27}}</ref>

These systems have different tradeoffs in terms of performance penalty, memory overhead, and classes of detected bugs. Stack protection is standard in certain operating systems, including [[OpenBSD]].<ref>{{cite web| url = https://man.openbsd.org/clang-local.1| title = OpenBSD's clang-local(1) manual page| quote = clang comes with stack protection enabled by default, equivalent to the ''-fstack-protector-strong'' option on other systems.}}</ref>