Resources

[jvoisin]

Documentation:

• https://android.googlesource.com/platform/bionic/+/refs/heads/master/docs/clang_fortify_anatomy.md
• clang-style FORTIFY
• https://maskray.me/blog/2022-11-06-fortify-source
• https://wiki.freebsd.org/SummerOfCode2015/FreeBSDLibcSecurityExtensions
• clang-style fortify and its corresponding issue
• https://developers.redhat.com/blog/2020/02/11/toward-_fortify_source-parity-between-clang-and-gcc
• A Eulogy for Format Strings — Captain Planet — Phrack Volume 0x0e, Issue 0x43, Phile #0x09 of 0x10
  
• https://copperhead.co/blog/hardening-bionic/

Implementations:

• include/linux/string.h: add the option of fortified string.h functions
• https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html
• https://sourceware.org/pipermail/gcc-patches/2004-September/150278.html
• https://github.com/jsonn/src/tree/trunk/include/ssp
• https://marc.info/?l=glibc-alpha&m=150511271003225&w=2
• FreeBSD:
  • https://reviews.freebsd.org/D3043
  • https://reviews.freebsd.org/D32306
  • from NetBSD: https://cgit.freebsd.org/src/commit/?id=be04fec42638f30f50b5b55fd8e3634c0fb89928
• Android:
  • https://android.googlesource.com/platform/bionic/+/master/libc/include/bits/fortify
  • https://android.googlesource.com/platform/bionic/+/16d1af167f8e36a9aa4a07ae77034ad519b00463%5E%21/
  • https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/4d7337a41b8c2b3da83a29f1dc8766eedb6e4ecf%5E%21/#F0
  • https://github.com/LineageOS/android_bionic/tree/lineage-20.0/libc/include/bits/fortify
• Apple:
  • https://opensource.apple.com/source/Libc/Libc-1439.40.11/secure/

User-facing documentation

• https://wiki.gentoo.org/wiki/User:Immolo/Fortify_Headers

Tests:

• https://github.com/serge-sans-paille/fortify-test-suite
• http://nsz.repo.hu/git/?p=libc-test;a=tree
• http://cvsweb.netbsd.org/bsdweb.cgi/src/tests/lib/libc/ssp/