Disable using __sprintf_chk()

Question

I observe that a c++ program uses sprintf, where this sprintf implicitly invokes __sprintf_chk(). This __sprintf_chk() seems to check buffer overflow by examining stack frames.

For my research purpose, I wonder if it is possible to disable using __sprintf_chk()?

Answer 1

Try to replace all calls to sprintf in your program from this:

 sprintf(params...);

into

 (sprintf)(params...);

This will disable any preprocessor-based sprintf-changing (* only if sprintf was changed using function-like macro like in the case of __sprintf_chk).

For gcc there are options -fno-stack-protector -fno-mudflap. May be also -D_FORTIFY_SOURCE=0 (for any glibc)

For Ubuntu and debian there are pages with security features list: http://wiki.debian.org/Hardening and https://wiki.ubuntu.com/Security/Features Some used compiler flags are listed here https://wiki.ubuntu.com/ToolChain/CompilerFlags

And there is a paper about SSP (stack-protector) and Fortify_source (glibc): http://www.linuxfromscratch.org/hints/downloads/files/ssp.txt

PS: the same for __fgets_chk __gets_chk __printf_chk __fprintf_chk __vprintf_chk __vfprintf_chk __vsprintf_chk __wmemcpy_chk __wmemmove_chk __wmempcpy_chk __wmemset_chk __wcscpy_chk __wcpcpy_chk __wcsncpy_chk __wcpncpy_chk __wcscat_chk __wcsncat_chk __swprintf_chk __vswprintf_chk __fwprintf_chk __wprintf_chk __vfwprintf_chk __vwprintf_chk __fgetws_chk __wcrtomb_chk __mbsrtowcs_chk __wcsrtombs_chk __mbsnrtowcs_chk __wcsnrtombs_chk __memcpy_chk __memmove_chk __mempcpy_chk __memset_chk __strcpy_chk __strncpy_chk __stpncpy_chk __strcat_chk and some others

Answer 2

This __sprintf_chk() seems to check buffer overflow by examining stack frames. ... For my research purpose, I wonder if it is possible to disable using __sprintf_chk()?

I believe that's from FORTIFY_SOURCE. There's quite a few functions guarded like that. I believe the following will work for you:

CFLAGS += -U_FORTIFY_SOURCE

Alternately, you might be able to:

CFLAGS += -D_FORTIFY_SOURCE=0

---

Related: if I encounter software in the field that disables FORTIFY_SOURCE, then I file a security defect against it. Its OK to disable ot for Debug and Testing, but its not appropriate for production software.

---

Related, here's a [potentially incomplete] list of functions that can be protected with FORTIFY_SOURCE:

• memcpy
• mempcpy
• memmove
• memset
• stpcpy
• strcpy
• strncpy
• strcat
• strncat
• sprintf
• snprintf
• vsprintf
• vsnprintf
• gets

See Difference between gcc -D_FORTIFY_SOURCE=1 and -D_FORTIFY_SOURCE=2.