Memory corruption and buffer overflow may result in exploit code injection attacks. For the C/C++ programming language, these can be protected by compiler options. By a properly secured configuration of a C/C++ compiler (GCC, MS Visual Studio), the application will be able to add an additional layer of runtime defenses against exploit code injection attacks. These are also mostly ignored by a development team. The common secure options are summarized in the following table:
|
Protection techniques
|
Secure options
|
OS/Compiler
|
| Address Space Layout Randomization (ASLR)
|
echo 1 >/proc/sys/kernel/randomize_va_space |
Android, Linux OS |
| Stack-based buffer overrun protection |
-fstack-protector –fstack-protector-all |
gcc |
| GOT Table Protection | -Wl,-z, relro | gcc |
| Dynamic link path | -Wl,--disable-new-dtags,--rpath [path] | gcc |
| Non-executable stack... |
