SSP(3)

💅 SSP(3) — bounds checked libc functions

okay bestie, so this is from the Library Functions Manual and it's literally the page for ssp, the buffer overflow protection library. it's giving "your libc but with a bodyguard" energy and honestly? slay. let's get into it 🫶

---

✨ NAME ✨

ssp — bounds checked libc functions. that's it, that's the whole vibe. 💖

---

🎀 LIBRARY 🎀

Buffer Overflow Protection Library, aka libssp, aka -lssp. that's the flag you link with, no cap. 🦋

---

🌸 SYNOPSIS 🌸

okay so first you gotta pull in the stdio ones:

#include <ssp/stdio.h>

int
sprintf(char *str, const char *fmt, ...);

int
vsprintf(char *str, const char *fmt, va_list ap);

int
snprintf(char *str, size_t len, const char *fmt, ...);

int
vsnprintf(char *str, size_t len, const char *fmt, va_list ap);

char *
fgets(char *str, int len, FILE *fp);

then the string girlies:

#include <ssp/string.h>

void *
memcpy(void *str, const void *ptr, size_t len);

void *
memmove(void *str, const void *ptr, size_t len);

void *
memset(void *str, int val, size_t len);

char *
stpcpy(char *str, const char *ptr);

char *
strcpy(char *str, const char *ptr);

char *
strcat(char *str, const char *ptr);

char *
strncpy(char *str, const char *ptr, size_t len);

char *
strncat(char *str, const char *ptr, size_t len);

the legacy strings girlies (yes they still get an invite):

#include <ssp/strings.h>

void *
bcopy(const void *ptr, void *str, size_t len);

void *
bzero(void *str, size_t len);

aaaaand the unistd crew:

#include <ssp/unistd.h>

ssize_t
read(int fd, void *str, size_t len);

int
readlink(const char * restrict path, char * restrict str, size_t len);

int
getcwd(char *str, size_t len);

periodt. 💅

---

🔥 DESCRIPTION 🔥

so here's the tea ☕ — when _FORTIFY_SOURCE bounds checking is enabled (the deets are right below), all the functions above get overwritten. overlapped. glow-upped. 👑

they start using __builtin_object_size(3) to compute the size of str, if it's known at compile time, and then they do a bounds check on it — all so you never get a data buffer or stack buffer overflow. it's literally the friend who holds your hair back, but for memory. 🧚

and if an overflow is detected? the routines call abort(3). not me getting kicked out of the function 😭💀. it's a hard no, not a warning, not a gentle nudge — abort(3). dramatic but honestly? iconic.

to turn on these function overrides, you add one of these to your clang(1) or gcc(1) command line:

-D_FORTIFY_SOURCE=1 or -D_FORTIFY_SOURCE=2

and the difference, bestie:

• if _FORTIFY_SOURCE is set to 1, the code computes the maximum possible buffer size for str
• if it's set to 2, it computes the minimum buffer size

that's the whole difference. 1 = max, 2 = min. write it on your hand. 🌈

---

💜 SEE ALSO 💜

• clang(1)
• gcc(1)
• __builtin_object_size(3)
• stdio(3)
• string(3)
• security(7)

go read security(7) if you're feeling brave, iykyk. 🦋

---

👑 HISTORY 👑

the ssp library showed up in NetBSD 4.0 — vintage, honestly. and this version of the ssp library? it replaced the GNU library of the same name in FreeBSD 12.2. glow up of the century fr fr. ✨

---

and that's the page, bestie 🎀 stay fortified, keep your buffer sizes known at compile time, and never let anyone overflow your stack. mwah. 💋

~ Debian, December 3, 2015 — signed, sealed, and slayed by SSP(3) ~ 🌸