Native libraries do not include stack canary protections

[AlonsoFloo]

Description

Current dotottie android library use a version of libc++_shared.so without stack canary

Concerned files :

armeabiv7a/libc++_shared.so
arm64-v8a/libc++_shared.so
x86/libc++_shared.so
x86_64/libc++_shared.so

Steps to reproduce

• Export .so file
• Run analysis on https://github.com/MobSF/Mobile-Security-Framework-MobSF (cloud utils ==> https://mobsf.live/)

Output :

This binary does not have a stack canary value added to the stack. Stack canaries are used to detect and prevent exploits from overwriting return address. Use the option -fstack-protector-all to enable stack canaries. Not applicable for Dart/Flutter libraries unless Dart FFI is used.

Proposition

Update build steps with gcc/clang flag -fstack-protector
Reference : https://developers.redhat.com/articles/2022/06/02/use-compiler-flags-stack-protection-gcc-and-clang#stack_usage_and_statistics

Screenshots