moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-21 23:58:49 -05:00
Code Issues Releases Wiki Activity

TODO: build: Enable PIE and RELRO by default

Browse Source
This commit is contained in:
Daniel Stenberg 2016-10-08 12:17:26 +02:00
parent e11da9f4b7
commit f74baaf3b3
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/TODO
View File

@ -154,6 +154,7 @@
19. Build
19.1 roffit
19.2 Enable PIE and RELRO by default
20. Test suite
20.1 SSL tunnel
@ -1014,6 +1015,19 @@ that doesn't exist on the server, just like --ftp-create-dirs.
Consider extending 'roffit' to produce decent ASCII output, and use that
instead of (g)nroff when building src/tool_hugehelp.c
19.2 Enable PIE and RELRO by default
Especially when having programs that execute cURL via the command line, PIE
renders the exploitation of memory corruption vulnerabilities a lot more
difficult. This can be attributed to the additional information leaks being
required to conduct a successful attack. RELRO, on the other hand, masks
different binary sections like the GOT as read-only and thus kills a handful
of techniques that come in handy when attackers are able to arbitrarily
overwrite memory. A few tests showed that enabling these features had close
to no impact, neither on the performance nor on the general functionality of
cURL.
20. Test suite
20.1 SSL tunnel