Web lists-archives.com

[PATCH v2 0/2] Enable Data Execution Protection and Address Space Layout Randomization on Windows




These two techniques make it harder to come up with exploits, by reducing
what is commonly called the "attack surface" in security circles: by making
the addresses less predictable, and by making it harder to inject data that
is then (mis-)interpreted as code, this hardens Git's executables on
Windows.

These patches have been carried in Git for Windows for over 3 years, and
should therefore be considered battle-tested.

Changes since v1:

 * When determining whether we build with optimization, -O0 and -Og are
   explicitly ignored.

İsmail Dönmez (2):
  mingw: do not let ld strip relocations
  mingw: enable DEP and ASLR

 config.mak.uname | 8 ++++++++
 1 file changed, 8 insertions(+)


base-commit: 83232e38648b51abbcbdb56c94632b6906cc85a6
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-134%2Fdscho%2Faslr-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-134/dscho/aslr-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/134

Range-diff vs v1:

 1:  e6acdba586 = 1:  828913e96c mingw: do not let ld strip relocations
 2:  e142c1396e ! 2:  9f1da73829 mingw: enable DEP and ASLR
     @@ -21,13 +21,13 @@
       --- a/config.mak.uname
       +++ b/config.mak.uname
      @@
     - 	ifeq ($(shell expr "$(uname_R)" : '2\.'),2)
     + 	ifneq ($(shell expr "$(uname_R)" : '1\.'),2)
       		# MSys2
       		prefix = /usr/
      +		# Enable DEP
      +		BASIC_LDFLAGS += -Wl,--nxcompat
      +		# Enable ASLR (unless debugging)
     -+		ifneq (,$(findstring -O,$(CFLAGS)))
     ++		ifneq (,$(findstring -O,$(filter-out -O0 -Og,$(CFLAGS))))
      +			BASIC_LDFLAGS += -Wl,--dynamicbase
      +		endif
       		ifeq (MINGW32,$(MSYSTEM))

-- 
gitgitgadget