Re: ffmpeg6 and SSP?

[Patrick Welche <prlw1%welche.eu@localhost>]

On Tue, Nov 14, 2023 at 11:30:27AM +0000, Patrick Welche wrote:
> On Tue, Nov 14, 2023 at 10:32:01AM +0000, Patrick Welche wrote:
> > On Mon, Nov 13, 2023 at 11:22:55AM +0000, Patrick Welche wrote:
> > > I'm pretty sure ffmpeg6 compiled recently, but on today's NetBSD-current
> > > with HAVE_GCC=12 and pkgsrc-current I'm seeing
> > > 
> > > => Bootstrap dependency digest>=20211023: found digest-20220214
> > > ===> Checking for vulnerabilities in ffmpeg6-6.0nb6
> > > ===> Building for ffmpeg6-6.0nb6
> > > LD      ffmpeg6_g
> > > LD      ffprobe6_g
> > > ld: /usr/lib/crt0.o and /usr/lib/crt0.o: warning: multiple common of `environ'
> > > ld: /usr/lib/crt0.o and /usr/lib/crt0.o: warning: multiple common of `environ'
> > > ld: libavdevice/libavdevice.so: undefined reference to `__ssp_protected_read'
> > > ld: libavdevice/libavdevice.so: undefined reference to `__ssp_protected_read'
> > > gmake: *** [Makefile:131: ffprobe6_g] Error 1
> > > gmake: *** Waiting for unfinished jobs....
> > > gmake: *** [Makefile:131: ffmpeg6_g] Error 1
> > > *** Error code 2
> > > 
> > > 
> > > Suggestions? Try no FORTIFY?
> > 
> > I tried "no FORTIFY" on ffmpeg6 as
> > 
> >   CONFIGURE_ENV+=        "CPPFLAGS=\"-D_FORTIFY_SOURCE=0\""
> > 
> > which didn't help.
> > 
> > I tried a NetBSD-current box with gcc 10.5.0 (i.e., without HAVE_GCC=12)
> > which didn't help.
> > 
> > I also see the problem with the simpler lang/gawk package:
> > 
> > ld: awkgram.o: in function `get_src_buf':
> > awkgram.c:(.text+0x2d8c): undefined reference to `__ssp_protected_read'
> > ld: io.o: in function `iop_alloc':
> > io.c:(.text+0xf03): undefined reference to `__ssp_protected_read'
> > ld: io.o: in function `get_a_record':
> > io.c:(.text+0x22d6): undefined reference to `__ssp_protected_read'
> > ld: io.o: in function `after_beginfile':
> > io.c:(.text+0x27c7): undefined reference to `__ssp_protected_read'
> > ld: io.o: in function `redirect_string':
> > io.c:(.text+0x55e7): undefined reference to `__ssp_protected_read'
> > ld: io.o:io.c:(.text+0x5606): more undefined references to `__ssp_protected_read' follow
> > 
> > If I simply edit /usr/include/ssp/ssp.h to remove the __gnu_inline__ from
> > the definition of__ssp_inline and make it static again, then gawk builds,
> > 
> > i.e., reverting
> > 
> > -/*     $NetBSD: ssp.h,v 1.14 2023/03/29 13:37:10 christos Exp $        */
> > +/*     $NetBSD: ssp.h,v 1.15 2023/11/10 23:03:37 christos Exp $        */
> > 
> > allows gawk to build.
> 
> Userland was built with MKUPDATE=yes - maybe I didn't rebuild whichever
> library should contain the extern definition of __ssp_protected_read ?
> 
> git grep ssp_protected_read
> 
> on https://github.com/NetBSD/src.git returned nothing - where should
> the __ssp_protected_read symbol live?


Thank you to Christos for putting the symbol in libc today with
the addition of ssp_redirect.c!

Before:
$ nm -g libc.so.12.221 | grep ssp
000000000007bb8a T _getfsspec
000000000007bb8a W getfsspec
000000000019717f T isspace
0000000000197195 T isspace_l
0000000000049f67 T wcsspn

After:
$ nm -g libc.so.12.221 | grep ssp
0000000000055136 T __ssp_protected_getcwd
000000000005512c T __ssp_protected_read
0000000000055131 T __ssp_protected_readlink
000000000007cc3a T _getfsspec
000000000007cc3a W getfsspec
000000000019822f T isspace
0000000000198245 T isspace_l
000000000004afb7 T wcsspn


Cheers,

Patrick