Re: ffmpeg6 and SSP?

[Patrick Welche <prlw1%welche.eu@localhost>]

On Tue, Nov 14, 2023 at 10:32:01AM +0000, Patrick Welche wrote:
> On Mon, Nov 13, 2023 at 11:22:55AM +0000, Patrick Welche wrote:
> > I'm pretty sure ffmpeg6 compiled recently, but on today's NetBSD-current
> > with HAVE_GCC=12 and pkgsrc-current I'm seeing
> > 
> > => Bootstrap dependency digest>=20211023: found digest-20220214
> > ===> Checking for vulnerabilities in ffmpeg6-6.0nb6
> > ===> Building for ffmpeg6-6.0nb6
> > LD      ffmpeg6_g
> > LD      ffprobe6_g
> > ld: /usr/lib/crt0.o and /usr/lib/crt0.o: warning: multiple common of `environ'
> > ld: /usr/lib/crt0.o and /usr/lib/crt0.o: warning: multiple common of `environ'
> > ld: libavdevice/libavdevice.so: undefined reference to `__ssp_protected_read'
> > ld: libavdevice/libavdevice.so: undefined reference to `__ssp_protected_read'
> > gmake: *** [Makefile:131: ffprobe6_g] Error 1
> > gmake: *** Waiting for unfinished jobs....
> > gmake: *** [Makefile:131: ffmpeg6_g] Error 1
> > *** Error code 2
> > 
> > 
> > Suggestions? Try no FORTIFY?
> 
> I tried "no FORTIFY" on ffmpeg6 as
> 
>   CONFIGURE_ENV+=        "CPPFLAGS=\"-D_FORTIFY_SOURCE=0\""
> 
> which didn't help.
> 
> I tried a NetBSD-current box with gcc 10.5.0 (i.e., without HAVE_GCC=12)
> which didn't help.
> 
> I also see the problem with the simpler lang/gawk package:
> 
> ld: awkgram.o: in function `get_src_buf':
> awkgram.c:(.text+0x2d8c): undefined reference to `__ssp_protected_read'
> ld: io.o: in function `iop_alloc':
> io.c:(.text+0xf03): undefined reference to `__ssp_protected_read'
> ld: io.o: in function `get_a_record':
> io.c:(.text+0x22d6): undefined reference to `__ssp_protected_read'
> ld: io.o: in function `after_beginfile':
> io.c:(.text+0x27c7): undefined reference to `__ssp_protected_read'
> ld: io.o: in function `redirect_string':
> io.c:(.text+0x55e7): undefined reference to `__ssp_protected_read'
> ld: io.o:io.c:(.text+0x5606): more undefined references to `__ssp_protected_read' follow
> 
> If I simply edit /usr/include/ssp/ssp.h to remove the __gnu_inline__ from
> the definition of__ssp_inline and make it static again, then gawk builds,
> 
> i.e., reverting
> 
> -/*     $NetBSD: ssp.h,v 1.14 2023/03/29 13:37:10 christos Exp $        */
> +/*     $NetBSD: ssp.h,v 1.15 2023/11/10 23:03:37 christos Exp $        */
> 
> allows gawk to build.

Userland was built with MKUPDATE=yes - maybe I didn't rebuild whichever
library should contain the extern definition of __ssp_protected_read ?

git grep ssp_protected_read

on https://github.com/NetBSD/src.git returned nothing - where should
the __ssp_protected_read symbol live?


Cheers,

Patrick