[tor-bugs] #12968 [Applications/Tor Browser]: Specify HEASLR (High Entropy Address Space Layout Randomization) in MinGW-w64

[Tor Bug Tracker & Wiki]

#12968: Specify HEASLR (High Entropy Address Space Layout Randomization) in
MinGW-w64
-------------------------------------------------+-------------------------
 Reporter:  mikeperry                            |          Owner:  tbb-
                                                 |  team
     Type:  enhancement                          |         Status:
                                                 |  needs_revision
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-security, tbb-rbm, ff60-esr,     |  Actual Points:
  TorBrowserTeam201806, boklm201806              |
Parent ID:  #24631                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by sukhbir):

 Replying to [comment:25 gk]:
 > Replying to [comment:24 sukhbir]:
 > > As an update, I have been trying to build and find a solution for this
 with boklm's changes above, and it fails with a similar error to the one
 boklm had.
 > >
 > > As per the `ffmpeg` commit, they apply `--image-base,0x140000000` to
 get a higher entropy for HEASLR. Since that is not working for us, how
 about we just go with `-Wl,--high-entropy-va` for now till we find a
 solution?
 >
 > What prevents us from finding that out now? Did you try to use
 `-mcmodel=medium` or `-mcmodel=large`? Why is ffpmeg not hitting the dwarf
 related problem in the first place? I.e. why is the linker not complaining
 for them?

 I tried (today) with `-mcmodel=medium`, `-mcmodel=large` (both with
 boklm's changes above and the GCC patch) and we have a similar if not the
 same error. As to why it works for ffmpeg, it seems they are using the
 same flags so I am not sure; I am going to compare the toolchain and see
 if there is a difference there.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12968#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online