gcc 太聪明了，无法生成 __strcpy_chk

Question

我的代码看起来像

struct MyData {
   int len;
   char data[1];
};

MyData *d1 = malloc(1024);
strcpy(d1->data, a_string);

我将它用作可变长度缓冲区，并小心地保证缓冲区不会溢出。但是程序崩溃了。

objdump -d

2f3dc:   48 8b 44 24 10          mov    0x10(%rsp),%rax
2f3e1:   48 89 ee                mov    %rbp,%rsi
2f3e4:   ba 01 00 00 00          mov    $0x1,%edx
2f3e9:   48 8d 78 20             lea    0x20(%rax),%rdi
2f3ed:   e8 ce b3 fd ff          callq  a7c0 <__strcpy_chk@plt>

我怎样才能说服 gcc 这个特定的缓冲区不会溢出并关闭对它的检查，但仍然对其他人进行检查。

BR/2021 年 4 月 2 日

这里是gcc-4.8编译的简化代码 ======>>>>

#include <string.h>

typedef struct _EncodedBuffer1 {
    int encoding;
    char data[1024];
} EncodedBuffer1;

typedef struct _EncodedBuffer2 {
    int encoding;
    char data[512];
} EncodedBuffer2;

typedef struct _MyData1 {
    int size;
    int data_type;

    union {
        bool bool_balue;
        int int_value;
        double double_value;
        char string1[1];
    };
    /* something else */
    union {
        struct {
            EncodedBuffer1 x_buf1;
            EncodedBuffer2 x_buf2;
        };
        struct {
            EncodedBuffer2 y_buf1;
            EncodedBuffer1 y_buf2;
        };
    };
} MyData1;

int main(int argc, char *argv[])
{
    MyData1 d1;
    memset(&d1, 0, sizeof(d1));
    d1.size = sizeof(d1);
    strcpy(d1.string1, argv[1]);
    return 0;
}

gcc -O2 -v

Using built-in specs.
COLLECT_GCC=gcc-4.8
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/4.8/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.8.5-4ubuntu2' --with-bugurl=file:///usr/share/doc/gcc-4.8/README.Bugs --enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-4.8 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.8 --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-libmudflap --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.8-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 4.8.5 (Ubuntu 4.8.5-4ubuntu2)
COLLECT_GCC_OPTIONS='-O2' '-v' '-mtune=generic' '-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.8/cc1plus -quiet -v -imultiarch x86_64-linux-gnu -D_GNU_SOURCE 2.cpp -quiet -dumpbase 2.cpp -mtune=generic -march=x86-64 -auxbase 2 -O2 -version -fstack-protector -Wformat -Wformat-security -o /tmp/cc7vXPnz.s
GNU C++ (Ubuntu 4.8.5-4ubuntu2) version 4.8.5 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.5, GMP version 6.1.0, MPFR version 3.1.3-p5, MPC version 1.0.3
warning: MPFR header version 3.1.3-p5 differs from library version 3.1.4.
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
ignoring duplicate directory "/usr/include/x86_64-linux-gnu/c++/4.8"
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory "/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/4.8
 /usr/include/x86_64-linux-gnu/c++/4.8
 /usr/include/c++/4.8/backward
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include-fixed
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
GNU C++ (Ubuntu 4.8.5-4ubuntu2) version 4.8.5 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.5, GMP version 6.1.0, MPFR version 3.1.3-p5, MPC version 1.0.3
warning: MPFR header version 3.1.3-p5 differs from library version 3.1.4.
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: f5d21a1dc5d9b70befc71d2006b2e7c5
COLLECT_GCC_OPTIONS='-O2' '-v' '-mtune=generic' '-march=x86-64'
 as -v --64 -o /tmp/ccpgLPzV.o /tmp/cc7vXPnz.s
GNU assembler version 2.26.1 (x86_64-linux-gnu) using BFD version (GNU Binutils for Ubuntu) 2.26.1
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../lib/:/lib/x86_64-linux-gnu/:/lib/../lib/:/usr/lib/x86_64-linux-gnu/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-O2' '-v' '-mtune=generic' '-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.8/collect2 --sysroot=/ --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -z relro /usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/crt1.o /usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/4.8/crtbegin.o -L/usr/lib/gcc/x86_64-linux-gnu/4.8 -L/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/4.8/../../.. /tmp/ccpgLPzV.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/x86_64-linux-gnu/4.8/crtend.o /usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/crtn.o

Answer 1

Gcc 不太聪明 - 它完全按照你告诉他的做，你的代码使用缓冲区溢出作为一个特性。

当你写你的例子时

struct MyData {
   int len;
   char data[1];
};

MyData *d1 = malloc(1024);
strcpy(d1->data, a_string);

gcc 看到一个 strcpy 以大小为 1 的缓冲区作为其目标调用 - 因为这是您在字段声明 char data[1]; 中告诉编译器的内容。 gcc 正像它应该的那样聪明。 声明MyData 的正确方法是使用zero sized array

struct MyData {
   int len;
   char data[0];
};