Example of Canary function

Kernel
1

Hi

Is there an example of a vApplicationGetRandomHeapCanary function somewhere to be found.
I am trying to understand the needed randomness-level. On my stm32G4 I am considering doing something like:

void vApplicationGetRandomHeapCanary(portPOINTER_SIZE_TYPE* pxHeapCanary ) {
	if (pxHeapCanary != NULL) {
		*pxHeapCanary = LL_RNG_ReadRandData32(RNG);
	}
}

Does that make sense?

Best regards
Martin

2

My understanding is that this doesn’t need to be a cryptologically random number, just a fairly random number (unless your heap corruption threat is actually malicious code). The idea is to make it very unlikely that a random write value generates a value that looks like it points to a valid value into the heap.

A Hardware generated Random number, like you are doing, will work but may be more “random” than you actually need, but if that doesn’t hurt your program, it is fine.

3

The value returned from the vApplicationGetRandomHeapCanary function is used to obfuscates heap block pointers by XORing them this value. More details in this PR - Heap protect by oliverlavery · Pull Request #747 · FreeRTOS/FreeRTOS-Kernel · GitHub.

Your implementation looks good. This function is only called once, so I think you do not need to worry too much about its performance.