Replace constant stack canary with per-task random #46
+23
−10
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit replaces fixed STACK_CANARY (0x33333333U) with per-task random canary generated using xorshift32 PRNG. This prevents trivial canary forgery attacks and significantly improves stack overflow detection.
The xorshift32 PRNG provides sufficient entropy for embedded systems without MMU/MPU support. Future enhancements can improve PRNG seeding with hardware entropy sources.
Close #8
Summary by cubic
Replaced the fixed stack canary with a per-task random canary to harden stack overflow detection and prevent trivial forgery. Each task gets its own canary from a lightweight xorshift32 PRNG seeded at boot with hardware entropy.
Written for commit 4a8087c. Summary will update automatically on new commits.