add ssp code and bump.

lib/libc/shlib_version

@@ -1,4 +1,4 @@
-#	$NetBSD: shlib_version,v 1.183 2006/10/25 23:49:31 christos Exp $
+#	$NetBSD: shlib_version,v 1.184 2006/11/08 20:58:23 christos Exp $
 #	Remember to update distrib/sets/lists/base/shl.* when changing
 #
 # things we wish to do on next major version bump:
@@ -17,4 +17,4 @@
 # - libc/net/getnet{ent,namadr}.c, netdb.h: remove __n_pad0
 #
 major=12
-minor=148
+minor=149

lib/libc/sys/Makefile.inc

@@ -1,4 +1,4 @@
-#	$NetBSD: Makefile.inc,v 1.169 2006/07/31 16:34:42 martin Exp $
+#	$NetBSD: Makefile.inc,v 1.170 2006/11/08 20:58:23 christos Exp $
 #	@(#)Makefile.inc	8.3 (Berkeley) 10/24/94
 
 # sys sources
@@ -22,6 +22,9 @@ DPSRCS+=	${_LSRC:MLintSys*.c}
 CLEANFILES+=	${_LSRC:MLintSys*.c}
 .endif
 
+# for -fstack-protector
+SRCS+=	stack_protector.c
+
 # glue to offer userland wrappers for some syscalls
 SRCS+=	sigtimedwait.c sigwait.c sigwaitinfo.c statvfs.c
 

lib/libc/sys/stack_protector.c

@@ -0,0 +1,108 @@
+/*	$NetBSD: stack_protector.c,v 1.1 2006/11/08 20:58:23 christos Exp $	*/
+/*	$OpenBSD: stack_protector.c,v 1.10 2006/03/31 05:34:44 deraadt Exp $	*/
+
+/*
+ * Copyright (c) 2002 Hiroaki Etoh, Federico G. Schwindt, and Miodrag Vallat.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+#include <sys/cdefs.h>
+__RCSID("$NetBSD: stack_protector.c,v 1.1 2006/11/08 20:58:23 christos Exp $");
+
+#include <sys/param.h>
+#include <sys/sysctl.h>
+#include <ssp/ssp.h>
+#include <signal.h>
+#include <string.h>
+#include <syslog.h>
+#include <unistd.h>
+
+extern int __sysctl(const int *, u_int, void *, size_t *, const void *, size_t);
+
+long __stack_chk_guard[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+static void __guard_setup(void) __attribute__((__constructor__, __used__));
+static void __fail(const char *);
+void __stack_chk_fail(void);
+void __chk_fail(void);
+
+/*LINTED used*/
+static void
+__guard_setup(void)
+{
+	int mib[2];
+	size_t len;
+
+	if (__stack_chk_guard[0] != 0)
+		return;
+
+	mib[0] = CTL_KERN;
+	mib[1] = KERN_ARND;
+
+	len = sizeof(__stack_chk_guard);
+	if (__sysctl(mib, 2, __stack_chk_guard, &len, NULL, 0) == -1 ||
+	    len != sizeof(__stack_chk_guard)) {
+		/* If sysctl was unsuccessful, use the "terminator canary". */
+		((unsigned char *)(void *)__stack_chk_guard)[0] = 0;
+		((unsigned char *)(void *)__stack_chk_guard)[1] = 0;
+		((unsigned char *)(void *)__stack_chk_guard)[2] = '\n';
+		((unsigned char *)(void *)__stack_chk_guard)[3] = 255;
+	}
+}
+
+/*ARGSUSED*/
+static void
+__fail(const char *msg)
+{
+	struct syslog_data sdata = SYSLOG_DATA_INIT;
+	struct sigaction sa;
+	sigset_t mask;
+
+	/* Immediately block all signal handlers from running code */
+	(void)sigfillset(&mask);
+	(void)sigdelset(&mask, SIGABRT);
+	(void)sigprocmask(SIG_BLOCK, &mask, NULL);
+
+	/* This may fail on a chroot jail... */
+	syslog_ss(LOG_CRIT, &sdata, msg);
+
+	(void)memset(&sa, 0, sizeof(sa));
+	(void)sigemptyset(&sa.sa_mask);
+	sa.sa_flags = 0;
+	sa.sa_handler = SIG_DFL;
+	(void)sigaction(SIGABRT, &sa, NULL);
+	(void)kill(getpid(), SIGABRT);
+	_exit(127);
+}
+
+void
+__stack_chk_fail(void)
+{
+	__fail("stack overflow detected; terminated");
+}
+
+void
+__chk_fail(void)
+{
+	__fail("buffer overflow detected; terminated");
+}