OcGuardLib: Add basic stackprotector to help to detect stack corruption

Debug/GdbSyms/GdbSyms.inf

@@ -48,6 +48,7 @@
   UefiBootServicesTableLib
   UefiDriverEntryPoint
   UefiLib
+  OcGuardLib
 
 [Guids]
 

Library/OcGuardLib/Canary.c

@@ -0,0 +1,39 @@
+/** @file
+
+OcGuardLib
+
+Copyright (c) 2018, vit9696
+
+All rights reserved.
+
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution.  The full text of the license may be found at
+http://opensource.org/licenses/bsd-license.php
+
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+//
+// TODO: For the cookie to work for security needs, the value is to be runtime
+// generated, e.g. with rdrand. For now this code is only written to help debugging
+// stack corruptions.
+//
+UINT64 __security_cookie = 0x9C7D6B4580C0BC9ULL;
+
+VOID
+__security_check_cookie (
+  IN UINTN  Value
+  )
+{
+  volatile UINTN  Index;
+
+  if (Value != (UINTN) __security_cookie) {
+    Index = 0;
+    while (Index == 0)
+    {
+    }
+  }
+}

Library/OcGuardLib/OcGuardLib.inf

@@ -30,6 +30,7 @@
 
 [Sources]
   BitOverflow.c
+  Canary.c
   NativeOverflow.c
   TripleOverflow.c
   UbsanPrintf.c
@@ -41,3 +42,9 @@
 
 [LibraryClasses]
   BaseLib
+
+
+[BuildOptions]
+  XCODE:DEBUG_*_*_CC_FLAGS   = -fno-stack-protector
+  XCODE:NOOPT_*_*_CC_FLAGS   = -fno-stack-protector
+  XCODE:RELEASE_*_*_CC_FLAGS = -fno-stack-protector

OcSupportPkg.dsc

@@ -143,6 +143,6 @@
   MSFT:DEBUG_*_*_CC_FLAGS    = $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
   MSFT:NOOPT_*_*_CC_FLAGS    = $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
   MSFT:RELEASE_*_*_CC_FLAGS  = $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
-  XCODE:DEBUG_*_*_CC_FLAGS   = $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
-  XCODE:NOOPT_*_*_CC_FLAGS   = $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
-  XCODE:RELEASE_*_*_CC_FLAGS = -Wno-error -flto $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
+  XCODE:DEBUG_*_*_CC_FLAGS   = -fstack-protector $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
+  XCODE:NOOPT_*_*_CC_FLAGS   = -fstack-protector $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)
+  XCODE:RELEASE_*_*_CC_FLAGS = -Wno-error -fstack-protector -flto $(OCSUPPORTPKG_BUILD_OPTIONS_GEN)