Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable trivial auto var init #1749

Closed
BayLee4 opened this issue Feb 2, 2022 · 2 comments
Closed

Enable trivial auto var init #1749

BayLee4 opened this issue Feb 2, 2022 · 2 comments
Labels
enhancement needs-triage

Comments

@BayLee4
Copy link
Contributor

BayLee4 commented Feb 2, 2022 •
edited
Loading

Is your feature request related to privacy?

Not really, it's mostly related to security.

Is there a patch available for this feature somewhere?

Yes : https://github.com/GrapheneOS/Vanadium/tree/12/patches

Describe the solution you would like

Merge the patches using the Clang compile option -ftrivial-auto-var-init=zero as it prevents memory corruption vulnerabilities related to uninitialized memory.

enable-ftrivial-auto-var-init-zero.patch
disable-broken-warning-for-auto-var-init.patch

Merge the patch enabling by default the Strict Origin Isolation flag, it should have no impact for devices with low memory as (afaik) Site Isolation is already disabled for them, and it increase the security of devices with sufficient memory. Enabling it would also help with #1720.

Enable-strict-origin-isolation-by-default.patch

Describe alternatives you have considered

• -ftrivial-auto-var-init=zero related patches : No simple alternative, as it's a compile time flag.
• Strict Origin Isolation related patch : Keep the flag disabled, and let users manually enabling it in chrome://flags if they want to.
@ghost
Copy link

ghost commented Feb 3, 2022

You can open a Pull Request

BayLee4 added a commit to BayLee4/bromite that referenced this issue Feb 4, 2022
@BayLee4
Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero…
c4d1f29 
…' and enable 'Strict Origin Isolation' by default
BayLee4 added a commit to BayLee4/bromite that referenced this issue Feb 4, 2022
@BayLee4
Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero…
0224ec1 
…' and enable 'Strict Origin Isolation' by default
BayLee4 added a commit to BayLee4/bromite that referenced this issue Feb 4, 2022
@BayLee4
Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero…
f8d726b 
…' and enable 'Strict Origin Isolation' by default
BayLee4 added a commit to BayLee4/bromite that referenced this issue Feb 4, 2022
@BayLee4
Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero'
4bb35df
@csagan5 csagan5 mentioned this issue Feb 4, 2022
Merged
@csagan5 csagan5 changed the title Merge some Vanadium security patches Enable trivial auto var init Feb 4, 2022
csagan5 pushed a commit that referenced this issue Feb 5, 2022
@csagan5
Resolve issue #1749 : build with '-ftrivial-auto-var-init=zero'
c46d636
@BayLee4 BayLee4 closed this as completed Feb 5, 2022
@csagan5 csagan5 reopened this Feb 5, 2022
@csagan5
Copy link
Contributor

csagan5 commented Feb 17, 2022

Fixed in 97.0.4692.106.

@csagan5 csagan5 closed this as completed Feb 17, 2022
ChanningPromethean pushed a commit to PrometheanWorld/bromite that referenced this issue May 12, 2023
@BayLee4
Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero'
c3b8b8a
ChanningPromethean pushed a commit to PrometheanWorld/bromite that referenced this issue May 12, 2023
Pull request bromite#21: AP9-4221 Update the Chromium application to …
25089f2 
…the latest version, from 95.0.4638.78 -> 98.0.4758.108

Merge in AP/chromiumpatches from upstream-98.0.4758.108 to master

* commit 'ea477210f4f7c4f64f0749d3e09f1f606116a82a': (46 commits)
  update to 98.0.4758.108, fix the conflict
  Release 98.0.4758.108
  Patches for v98 (bromite#1806)
  Fix an URL in FAQs (bromite#1815)
  Remove unused patch
  Release 97.0.4692.106
  Patches for v97 (bromite#1795)
  Updated automated domain substitution patch
  Rename GN_ARGS -> bromite.gn_args
  Add missing architectures
  Adjust issue forms
  Minor patch updates for v97
  Migrate to using GitHub issue forms
  Add FAQ about default search engine
  Remove [PATCH] from patches
  Resolve issue bromite#1749 : build with '-ftrivial-auto-var-init=zero'
  Release 96.0.4664.183
  Update zh_CN translations (bromite#1696)
  Updated CHANGELOG
  Release 96.0.4664.104
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement needs-triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@csagan5 @kokukyocho @BayLee4