facedetection包含的libmnnfacedetection.so存在编译选项相关安全风险,请关注解决
- Dominant language
- Objective-C
- Stars
- 702
- Forks
- 119
- PR merge metrics
- No merged PRs in 30d
Description
facedetection-0.0.5.aar中的resources\jni\arm64-v8a\libmnnfacedetection.so,没有使用-fstack-protector-all或-fstack-protector-strong编译选项。可能导致缓冲区溢出攻击漏洞,导致应用程序被恶意劫持或崩溃。
按编译器不同:
1.GCC4.9版本及以上可使用-fstack-protector-strong进行加固
2.GCC4.9版本以下可使用-fstack-protector-all进行加固
请facedetection提供经过安全的编译选项加固后的so,谢谢
参考链接:https://android-developers.googleblog.com/2016/07/protecting-android-with-more-linux.html
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with facedetection-0.0.5.aar and inspect resources/jni/arm64-v8a/libmnnfacedetection.so, then locate the build configuration that produces this native library. Verify the rebuilt .so uses the requested stack-protection compiler option and confirm the secured library is included in the AAR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100