istream's tellg/seekg cannot be protected from stack smashing (g++)?

Question

For a program that I'm writing, it is useful for me to calculate file sizes, which I calculate by using iostream's tellg and seekg functions, but this leads to a warning by -Wstack-protector. The following code reproduces the "problem":

#include <iostream>

std::streamsize get_file_size(std::ifstream& ifs) { // line 12 (in warning, below)
  const std::streamsize start = ifs.tellg();
  ifs.seekg(0,std::ios::end);
  const std::streamsize end = ifs.tellg();
  ifs.seekg(start);
  return (end-start);
}

g++ (flags: -fstack-protector -Wstack-protector, compiler version: 4.4.3 (Ubuntu 4.4.3-4ubuntu5), system: Ubuntu 10.04 x86_64) gives the warning:

f.cc: In function ‘std::streamsize get_file_size(std::ifstream&)’:
f.cc:12: warning: not protecting function: no buffer at least 8 bytes long

(I get the same results when I use GCC 4.5.2, downloaded and compiled from GNU directly.)

Is this expected from how stack smashing protection works (in general or by GCC) and/or how ifstream and seekg/tellg work? If so, can't this warning be ignored or is there something better that I can do?

Edit:

Actually, some of the code above is redundant. Just to clarify what's going on:

#include <iostream>

void f1(std::ifstream& ifs) { // line 6
    ifs.tellg();
}

void f2(std::ifstream& ifs) { // line 10
    // call seekg(std::streampos)
    ifs.seekg(0);
}

void f3(std::ifstream& ifs) {
    // call seekg(std::streamoff, std::ios_base::seekdir)
    ifs.seekg(0,std::ios::beg);
}

leads to g++ (same specs as above) warning:

main.cc: In function ‘void f1(std::ifstream&)’:
main.cc:6: warning: not protecting function: no buffer at least 8 bytes long
main.cc: In function ‘void f2(std::ifstream&)’:
main.cc:10: warning: not protecting function: no buffer at least 8 bytes long

Interestingly, f3 does not trigger a warning.

score 1 · Accepted Answer · edited May 23 '17 at 12:12

1

You might wan't to see this.

And the general advice is you really shouldn't care, especially in your case, when you don't allocate any internal buffers that can be used to perform buffer overflow attack.

edited May 23 '17 at 12:12

Community

1
1

answered Feb 01 '11 at 15:59

Yippie-Ki-Yay

22,026
26
90
148

Thanks for the link (although I think it was reading that page that lead me to include -Wstack-protector in my program build!). The fact that I haven't put any buffers in `get_file_size` that can be exploited is the reason I asked the question: why is the warning even coming up? Even if I can ignore it in practise, I'd still prefer some knowledge about what's going on, for my benefit. – Zorawar Feb 01 '11 at 16:14
@Zorawar Well, I'm not that good at practical buffer overrun techniques, so I guess we'll have to wait for a person with a particular set of skills to explain how this can or can't be exploited ) – Yippie-Ki-Yay Feb 01 '11 at 16:22
1

maybe I should facilitate participation by mentioning that I found the code on a file called "NSA Project X humanoid language translator"? (Just kidding NSA! It was from MI6...) – Zorawar Feb 01 '11 at 16:40

istream's tellg/seekg cannot be protected from stack smashing (g++)?

1 Answers1