Example of Canary function


Is there an example of a vApplicationGetRandomHeapCanary function somewhere to be found.
I am trying to understand the needed randomness-level. On my stm32G4 I am considering doing something like:

void vApplicationGetRandomHeapCanary(portPOINTER_SIZE_TYPE* pxHeapCanary ) {
	if (pxHeapCanary != NULL) {
		*pxHeapCanary = LL_RNG_ReadRandData32(RNG);

Does that make sense?

Best regards

My understanding is that this doesn’t need to be a cryptologically random number, just a fairly random number (unless your heap corruption threat is actually malicious code). The idea is to make it very unlikely that a random write value generates a value that looks like it points to a valid value into the heap.

A Hardware generated Random number, like you are doing, will work but may be more “random” than you actually need, but if that doesn’t hurt your program, it is fine.

The value returned from the vApplicationGetRandomHeapCanary function is used to obfuscates heap block pointers by XORing them this value. More details in this PR - Heap protect by oliverlavery · Pull Request #747 · FreeRTOS/FreeRTOS-Kernel · GitHub.

Your implementation looks good. This function is only called once, so I think you do not need to worry too much about its performance.