fpc-generated object files are marked as requiring executable stacks
Original Reporter info from Mantis: truedfx
-
Reporter name: Harald van Dijk
Original Reporter info from Mantis: truedfx
- Reporter name: Harald van Dijk
Description:
Programs such as
program ExecStack;
procedure DoIt;
type
proc = procedure;
var
ret: Byte;
DoNothing: proc;
begin
ret := $C3;
DoNothing := proc(@ret);
DoNothing;
end;
begin
DoIt;
end.
should be made to segfault, as the GNU tools do for the corresponding C program. Code rarely needs to be placed on the stack, and it should be disallowed unless specifically requested. GNU/Linux systems default to marking the stack as executable, and let programs specify they don't need it. GNU's linker does this if all of its input files say they do not need code on the stack. fpc-generated object files don't say so, even though they don't need it.
Additional information:
Object files can specify they don't need an executable stack, and when using gas, this can be done by placing
.section .note.GNU-stack,"",%progbits
at the end of the assembly file. You can wrap the above in
#if defined(linux) && defined(ELF)
...
#endif
to minimise changes on other systems, or you can move the check in fpc itself.
The same change needs to be made when fpc writes object files directly, too, and there
TElfObjSection.create_ext(ObjSectionList,'.note.GNU-stack',SHT_PROGBITS,0,0,0,1,0);
in TElfObjectOutput.writedata can be used, possibly again with a check that an object file for Linux is generated.
Aside from that, fpc sources include some assembly files, which would need to be modified directly the way mentioned above. With all that changed, the ExecStack program aborts with runtime error 216, which is exactly what I'm hoping to see. And a Linux livecd from as early as February 2000 has no problems running correct programs generated by a modified fpc, so there should be no backwards compatibility concerns.
For more info: http://www.gentoo.org/proj/en/hardened/gnu-stack.xml
A possible problem is that some software written in FreePascal may directly choose to place code on the stack, similar to what I was told Lazarus used to do on the heap. To satisfy these programs, a compiler option can be added so that fpc continues to generate object files the way it does now, and the programs continue to work as they used to.
Mantis conversion info:
- Mantis ID: 11563
- Version: 2.2.0
- Fixed in version: 2.4.0
- Fixed in revision: 12356 (#3216e8c7)
- Monitored by: » tbzatek (Tomas Bzatek)
- Target version: 2.4.0