[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Introducing security hardening features for Lenny



On Tue, Jan 29, 2008 at 11:47:57PM +0000, brian m. carlson wrote:
> In conclusion, there is no appreciable performance hit on any algorithm.  
> Note that these are all hash algorithms, but they all make heavy use of 
> memcpy, and are extremely CPU-intensive.

  OTOH the memcpy they use are statically checkable, so it's not a good
test. the _chk versions of memcpy that are used are builtins in gcc that
reduce to a simple memcpy if gcc was able to say statically if the bound
was OK. Hash algorithms are not that good for checks for those features
because their stack depth is usually thin, and boundaries easily
checked.

  That's why I suggested testing encoding/decoding multimedia streams
instead, or heavy text processors (xslt, docbook, ...) come to mind.


-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

Attachment: pgpy0tguq32sa.pgp
Description: PGP signature


Reply to: