Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1 « Software and web application security

Wed, 04 Apr 2007 20:33:24 GMT

PingBack from http://chrisweber.wordpress.com/2007/04/04/hardening-stack-based-buffer-overrun-detection-in-vc-2005-sp1/

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

Yoink — Thu, 05 Apr 2007 09:24:06 GMT

Do Microsoft care to explain what 'If a parameter is used only in ways that are less likely to be exploitable in the event of a buffer overrun.' means?

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

michael_HOWARD — Thu, 05 Apr 2007 16:50:42 GMT

The sample code above shows the main one - using non-chars as the buffer element type

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

ddebug — Wed, 11 Apr 2007 00:36:59 GMT

Is this correct that /GS can make copies of vulnerable parameters on stack, and thus increase stack usage much more and less predictably than we could guess? (8 bytes per call frame)

Is there any easy way to know when the compiler makes big allocations on stack? This may be important for kernel mode, where stack is limited.

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

michael_HOWARD — Wed, 11 Apr 2007 04:20:57 GMT

ddebug,

yes it's true, but in our experience, it's really not a big issue. We saw now perf problems or stack exhaustion.

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

Alexander Sotirov — Wed, 18 Apr 2007 19:47:18 GMT

Does using this flag enable /GS cookies for the LoadAniIcon function which was responsible for the recent ANI vulnerability? It was a perfect example of a function which should have been protected by /GS, but the compiler failed to insert the cookie because the function was overwriting a structure on the stack, instead of an array.

By the way, what exact version of VC2005 was used to compile Vista? Is it the same one that's included in the Vista release of the Windows SDK, or a private build of the compiler?

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

michael_HOWARD — Wed, 18 Apr 2007 21:19:07 GMT

Hello Alexander

re: /GS - yes, the #pragma would add the cookie to this func.

Lessons learned from the Animated Cursor Security Bug

The Security Development Lifecycle — Fri, 27 Apr 2007 01:56:58 GMT

Michael Howard here. A core tenet of the SDL is to take and incorporate lessons learned when we issue

re: Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1

anonymous — Sat, 28 Apr 2007 22:55:26 GMT

I have VS2005 SP1 running, but the compiler complains that this pragma simply doesn't exist. What now?