romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-21 14:02:11 +03:00
Code Issues Projects Releases Packages Wiki Activity

TODO: build: Enable PIE and RELRO by default

Browse source
This commit is contained in:
Daniel Stenberg 2016-10-08 12:17:26 +02:00
parent e11da9f4b7
commit f74baaf3b3
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/TODO
View file

@ -154,6 +154,7 @@
19. Build
19.1 roffit
19.2 Enable PIE and RELRO by default
20. Test suite
20.1 SSL tunnel
@ -1014,6 +1015,19 @@ that doesn't exist on the server, just like --ftp-create-dirs.
Consider extending 'roffit' to produce decent ASCII output, and use that
instead of (g)nroff when building src/tool_hugehelp.c
19.2 Enable PIE and RELRO by default
Especially when having programs that execute cURL via the command line, PIE
renders the exploitation of memory corruption vulnerabilities a lot more
difficult. This can be attributed to the additional information leaks being
required to conduct a successful attack. RELRO, on the other hand, masks
different binary sections like the GOT as read-only and thus kills a handful
of techniques that come in handy when attackers are able to arbitrarily
overwrite memory. A few tests showed that enabling these features had close
to no impact, neither on the performance nor on the general functionality of
cURL.
20. Test suite
20.1 SSL tunnel