How does the gcc option -fstack-check exactly work?

Question

My program crashed when I added the option -fstack-check and -fstack-protector. __stack_chk_fail is called in the back trace.

So how could I know where the problem is ? What does -fstack-check really check ? The information about gcc seems too huge to find out the answer.

Answer 1

According to this "`-fstack-protector' Emit extra code to check for buffer overflows, such as stack smashing attacks. This is done by adding a guard variable to functions with vulnerable objects. This includes functions that call alloca, and functions with buffers larger than 8 bytes. The guards are initialized when a function is entered and then checked when the function exits. If a guard check fails, an error message is printed and the program exits"

GCC Options That Control Optimization

GCC extension for protecting applications from stack-smashing attacks

Smashing The Stack For Fun And Profit

I Hope this will give some clue..

Answer 2

After checked the assembly program. I think -fstack-check, will add code write 0 to an offset of the stack pointer, so to test if the program visit a violation address, the program went crash if it does. e.g. mov $0x0,-0x928(%esp)