Instrumentation Options (Using the GNU Compiler Collection (GCC))

When C, C++ and the Internet were conceived, they were mostly used by academics. Attacks on computer systems were rare, since there was not much incentive to it, so there did not have to be

Writing R Extensions

Writing R Extensions

20 September 2023 by Phillip Johnston • Last updated 28 September 2023Your toolchain is a useful place to start when incorporating security into your development process. There are several warnings and program augmentations that help harden your application. This article focuses on GCC and Clang, as that’s what I primarily use. I’m happy to take … Continue reading "Leveraging Your Toolchain to Improve Security"

I discovered during the analysis of the CVE-2021-31616 vulnerability that the stack canary logic in the KeepKey firmware was broken and could be bypassed to perform practical stack smashing attacks. Further investigation revealed that the incorrect stack protection assembler code is produced through a bug in certain GCC 9 and GCC 10 compiler versions for ARM, where it has been present for about a year. This problem has the potential to affect a wide range of ARM based embedded systems.

code { white-space : pre-wrap !important; } This article is tightly scoped to cover one topic with specific, actionable advice: How to configure...

Writing R Extensions

Blog about C++, C, Undefined Behavior and Compilers

This is a list of materials (documents, services, and so on) released by the Open Source Security Foundation (OpenSSF) Best Practices Working Group (WG).

The GNU C Library