enable -fstack-protector-strong
This results in nearly all functions with the possibility of stack
corruption getting stack canaries, because it applies to any function
taking a reference to the frame or with a local array rather than just
the functions with arrays larger than 8 bytes. It was developed for use
in Chrome (and Chrome OS) and has also been adopted by various other
distributions (Arch, Fedora, Ubuntu, etc).
The code size increase ranges from ~1.5% to ~2.5%, compared to ~0.3% to
~0.7% with the more conservative switch. The increase in the performance
loss is usually minimal. The overall size increase once everything other
than C and C++ code is taken into account is minimal, and it greatly
improves the mitigation of stack buffer overflow vulnerabilities.
https://lwn.net/Articles/584225/
Change-Id: Ie83d381e09d94deb34c5ff142a101ba3d14cf3ba
diff --git a/core/combo/TARGET_linux-arm.mk b/core/combo/TARGET_linux-arm.mk
index 485e48c..1eb30d0 100644
--- a/core/combo/TARGET_linux-arm.mk
+++ b/core/combo/TARGET_linux-arm.mk
@@ -101,7 +101,7 @@
-ffunction-sections \
-fdata-sections \
-funwind-tables \
- -fstack-protector \
+ -fstack-protector-strong \
-Wa,--noexecstack \
-Werror=format-security \
-D_FORTIFY_SOURCE=2 \
diff --git a/core/combo/TARGET_linux-arm64.mk b/core/combo/TARGET_linux-arm64.mk
index 18bdbe7..a300aaf 100644
--- a/core/combo/TARGET_linux-arm64.mk
+++ b/core/combo/TARGET_linux-arm64.mk
@@ -75,7 +75,7 @@
-fno-strict-aliasing \
TARGET_GLOBAL_CFLAGS += \
- -fstack-protector \
+ -fstack-protector-strong \
-ffunction-sections \
-fdata-sections \
-funwind-tables \
diff --git a/core/combo/TARGET_linux-x86.mk b/core/combo/TARGET_linux-x86.mk
index c4cb0f8..dbe1612 100644
--- a/core/combo/TARGET_linux-x86.mk
+++ b/core/combo/TARGET_linux-x86.mk
@@ -94,7 +94,7 @@
-fstrict-aliasing \
-funswitch-loops \
-funwind-tables \
- -fstack-protector \
+ -fstack-protector-strong \
-m32 \
-no-canonical-prefixes \
-fno-canonical-system-headers \
diff --git a/core/combo/TARGET_linux-x86_64.mk b/core/combo/TARGET_linux-x86_64.mk
index b7ec50b..99bac72 100644
--- a/core/combo/TARGET_linux-x86_64.mk
+++ b/core/combo/TARGET_linux-x86_64.mk
@@ -94,7 +94,7 @@
-fstrict-aliasing \
-funswitch-loops \
-funwind-tables \
- -fstack-protector \
+ -fstack-protector-strong \
-m64 \
-no-canonical-prefixes \
-fno-canonical-system-headers
