405523 - Add dynamicbase flag (build with ASLR when available)

Status: RESOLVED FIXED

(Firefox Build System :: General, defect, P1)

Description

[Window Snyder]

Investigate linking with /dynamicbase (ASLR in Vista.)

Comment 1

[Benjamin Smedberg]

As noted in the other bug, /dynamicbase isn't supported by MSVC8, only MSVC8SP1, and isn't documented on MSDN (only noted in a couple of security blogs)... this makes me nervous, and it's also pretty complex to write a configure test for.

Comment 2

[timeless]

http://blogs.msdn.com/michael_howard/archive/2006/10/04/Alleged-Bugs-in-Windows-Vista_1920_s-ASLR-Implementation.aspx

it is documented:
http://msdn2.microsoft.com/en-us/library/bb384887.aspx

Comment 3

[Mike Connor [:mconnor]]

Does the ref platform use SP1 now?  Is that risky or can we get this?  I'm more than ok with bumping requirements to MSVC8 SP1 if it gets us better mitigation against attacks.  This seems like a solid win for minimal effort.

Comment 4

[(not currently active) Ted Mielczarek]

The refplatform uses SP1. Should be easy to turn this on if you want it.

Comment 5

[Benjamin Smedberg]

I don't want to turn this on without a configure check so that we don't break builders with plain VC8 or VC71

Comment 6

[(not currently active) Ted Mielczarek]

Attachment: use dynamicbase on vc8sp1 or newer

This WFM, although I didn't do a full build with it, I just re-built spidermonkey and verified it linked properly.

Comment 7

[(not currently active) Ted Mielczarek]

Comment on attachment 306914 [details] [diff] [review]
use dynamicbase on vc8sp1 or newer

Oops, VC8 only differs from SP1 in the fourth version component. New patch in a bit.

Comment 8

[(not currently active) Ted Mielczarek]

Attachment: better

Right, this should not fail on plain VC8.

Comment 9

[(not currently active) Ted Mielczarek]

Here's a build with this patch if anyone wants to do some testing on Vista:
https://build.mozilla.org/tryserver-builds/2008-03-04_02:[e-mail]-dynamicbase/[e-mail]
https://build.mozilla.org/tryserver-builds/2008-03-04_02:[e-mail]-dynamicbase/[e-mail]

Comment 10

[(not currently active) Ted Mielczarek]

Checked in. Someone should test this to make sure it doesn't cause any bustage on Vista. Guess we'll find out in tomorrow's nightlies!

Comment 11

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Ted: 

1) With this enabled, did the nightlies pass all tests ok?

2) Is there anything beyond your landed "configure.in" changes that we need in release automation to ship with this? 

Comment 12

[(not currently active) Ted Mielczarek]

John:
1) I haven't seen any evidence otherwise (Talos boxes are fine, and I haven't seen any bugs filed yet)
2) Nope, this gets enabled by default if your compiler supports it