How exactly does the gcc -fstack-check function work?

Question

My program crashed when I added the -fstack-check and -fstack-protector options. __stack_chk_fail is called in the return trace.

So how can I find out where the problem is? What does -fstack-check really check? The gcc info seems too huge to know the answer.

Answer 1

After checking the build program. I think that -fstack-check will add the write 0 code to the offset of the stack pointer, therefore, to check if the program visited the violation address, the program crashed if that happens. e.g. mov $ 0x0, -0x928 (% esp)

Answer 2

"-fstack-protector 'emits additional code to check for buffer overflows, such as stack breaking attacks. This is done by adding a security variable to functions with vulnerable objects. This includes functions that call alloca and functions with buffers larger than 8 bytes. Guards are initialized when a function is entered, and then checked when the function exits. If the security check fails, an error message appears and the program exits

GCC parameters that control optimization

GCC extension to protect applications from glass-based attacks

Stack breaking for fun and profit

Hope this gives some insight.

Answer 3

-fstack-check : If the two macro values STACK_CHECK_BUILTIN and STACK_CHECK_STATIC_BUILTIN remain at default 0, it simply inserts NULL bytes every 4kb (page) when the stack grows. By default, only one, but when the stack can grow more than one page, which is the most dangerous case, every 4 KB. linux> 2.6 has only one small page gap between the stack and the heap, which can lead to stack attacks known since 2005. See What exception has been added to C for the GCC -fstack-check option for assembly. It has been included in gcc since at least 2.95.3, in clang since 3.6.

__stack_chk_fail is the inserted code -fstack-protector , which checks the inserted stock value of the channel, which can be overwritten by a simple stack overflow, for example. recursion.