Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable Data Execution Protection and Address Space Layout Randomization on Windows #134

Closed
wants to merge 2 commits into from
Closed

Enable Data Execution Protection and Address Space Layout Randomization on Windows #134

wants to merge 2 commits into from

Commits on May 6, 2019

  1. mingw: do not let ld strip relocations 

    This is the first step for enabling ASLR (Address Space Layout
Randomization) support. We want to enable ASLR for better protection
against exploiting security holes in Git: it makes it harder to attack
software by making code addresses unpredictable.

The problem fixed by this commit is that `ld.exe` seems to be stripping
relocations which in turn will break ASLR support. We just make sure
it's not stripping the main executable entry.

Signed-off-by: İsmail Dönmez <ismail@i10z.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
    @ismail @dscho
    ismail authored and dscho committed May 6, 2019
    Configuration menu
    Copy the full SHA
    828913e View commit details
    Browse the repository at this point in the history

  2. mingw: enable DEP and ASLR 

    Enable DEP (Data Execution Prevention) and ASLR (Address Space Layout
Randomization) support. This applies to both 32bit and 64bit builds
and makes it substantially harder to exploit security holes in Git by
offering a much more unpredictable attack surface.

ASLR interferes with GDB's ability to set breakpoints. A similar issue
holds true when compiling with -O2 (in which case single-stepping is
messed up because GDB cannot map the code back to the original source
code properly). Therefore we simply enable ASLR only when an
optimization flag is present in the CFLAGS, using it as an indicator
that the developer does not want to debug in GDB anyway.

Signed-off-by: İsmail Dönmez <ismail@i10z.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
    @ismail @dscho
    ismail authored and dscho committed May 6, 2019
    Configuration menu
    Copy the full SHA
    9f1da73 View commit details
    Browse the repository at this point in the history