{"push_id":771557495,"size":13,"distinct_size":13,"ref":"refs/heads/cm-12.1","head":"07346b286a804d4003ee00a9c6ff7b745ae21ab5","before":"1a9edcdce8f32cba9ae81f0d2680aaedf9459ea6","commits":[{"sha":"6f4bd5f4c221dd7e4942d613d6fe423ba89fae12","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Drop check-glibc.sh.\n\nWe're already building against an older version of libc to prevent\nthis. This list doesn't seem to be up to date anyway, we definitely\ndon't support anything older than 2.11.\n\nChange-Id: Ifb3d249c0628c4ba5c30280b29dfa37d33df4e34","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/6f4bd5f4c221dd7e4942d613d6fe423ba89fae12"},{"sha":"bd46a6b7d9e03fcbae0cdb4cdc08abc7bcbd65ca","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Merge \"Drop check-glibc.sh.\"","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/bd46a6b7d9e03fcbae0cdb4cdc08abc7bcbd65ca"},{"sha":"a11bcc443f8f091f6533724e6e03a7b7f037c8d3","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Stop supporting NDK_HOST_32BIT.\n\nThis option allowed the user to request the 32-bit toolchains on a\n64-bit system. The only 32-bit toolchains we still build are Windows,\nand if they need those they can just use the 32-bit NDK.\n\nChange-Id: I1c601de67ab7aac9d1ef7ff5ece9d6c9e07434e9","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/a11bcc443f8f091f6533724e6e03a7b7f037c8d3"},{"sha":"a3ba02cac75714bfc2f2698cdd97a9277332a6bb","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Fix toolchain location for ndk-build.\n\nToolchains have been rearranged to have the host tag be at the top\nlevel rather than the target architecture.\n\nBug: http://b/23362228\nChange-Id: I4a1e5bb3c6f48d788369204222780af407c34070","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/a3ba02cac75714bfc2f2698cdd97a9277332a6bb"},{"sha":"8fc7d9f8c2f5bead745fe15e1bf8762752a636a3","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Fix LLVM toolchain layout to match GCC.\n\nBug: http://b/23362228\nChange-Id: I399770201b403e5df9be2d1e7eb45c7965236ba9","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/8fc7d9f8c2f5bead745fe15e1bf8762752a636a3"},{"sha":"b81680a328b963e739521d5b7086d2d1af3f5b00","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Merge \"Stop supporting NDK_HOST_32BIT.\"","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/b81680a328b963e739521d5b7086d2d1af3f5b00"},{"sha":"feb8203affc1fb2f918bb7aae21ad74470880195","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Merge \"Fix toolchain location for ndk-build.\"","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/feb8203affc1fb2f918bb7aae21ad74470880195"},{"sha":"e1bf3b9bfb061330fe0609788baa6dcfc3ca0a0f","author":{"email":"1cd2cba3b8945658213f6bb923bd9481c9e8d1fe@google.com","name":"Dan Albert"},"message":"Merge \"Fix LLVM toolchain layout to match GCC.\"","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/e1bf3b9bfb061330fe0609788baa6dcfc3ca0a0f"},{"sha":"0b1387e0f9c95d08812ee334441635c85d9ae64d","author":{"email":"5ee0403474a02eab957842a21d94801ccca86e8c@google.com","name":"Josh Gao"},"message":"Add missing targets to helper functions.\n\nChange-Id: I17fe978cc9a6fad863b3c7692e82891552c89829","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/0b1387e0f9c95d08812ee334441635c85d9ae64d"},{"sha":"3becdd10b88047d79f16aa0fcc4a771fdc8e6ce4","author":{"email":"5ee0403474a02eab957842a21d94801ccca86e8c@google.com","name":"Josh Gao"},"message":"Merge \"Add missing targets to helper functions.\"","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/3becdd10b88047d79f16aa0fcc4a771fdc8e6ce4"},{"sha":"71bf3311bc5ad366eb313cd1453091b455bad20f","author":{"email":"28efa798da98745d6a98078b320edd33f229eda6@gmail.com","name":"Daniel Micay"},"message":"start using _FORTIFY_SOURCE=1 for NDK applications\n\nThe entire base system is already compiled with _FORTIFY_SOURCE=2 but\nNDK applications only use it if they explicitly opt-in. In practice,\nthat means *very* few NDK applications have this exploit mitigation.\n\nEnabling _FORTIFY_SOURCE=1 by default does not deviate from standards\ncompliance and won't break code that's not corrupting memory. It can be\ndisabled or fully enabled (2) via LOCAL_FORTIFY_LEVEL. It would be risky\nto use _FORTIFY_SOURCE=2 by default because it can break rare edge cases\ninvolving overflows within the bounds of an object.\n\nPartially enabling this will still mitigate a lot of buffer overflows\nand the documentation can strongly recommend LOCAL_FORTIFY_LEVEL=2.\n\nChange-Id: Iba14eaf1a6c94d5420f47d2ce60febd501e9421d","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/71bf3311bc5ad366eb313cd1453091b455bad20f"},{"sha":"cafd7d42969e262530e17004f6bca571d71d3071","author":{"email":"28efa798da98745d6a98078b320edd33f229eda6@gmail.com","name":"Daniel Micay"},"message":"switch to using _FORTIFY_SOURCE=2 by default\n\nChange-Id: I20f758605fb0e5c80dfe13c9a000bf5026b07b69","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/cafd7d42969e262530e17004f6bca571d71d3071"},{"sha":"07346b286a804d4003ee00a9c6ff7b745ae21ab5","author":{"email":"28efa798da98745d6a98078b320edd33f229eda6@gmail.com","name":"Daniel Micay"},"message":"use -fstack-check for GCC on x86 and x86_64\n\nThe -fstack-check switch prevents harmful stack overflows by enforcing\nthe guarantee that the guard page at the end of stacks will be hit. It\ndoes this by injecting one byte writes for large uninitialized frames\nand any usage of alloca. It rarely needs to do anything because these\ncases are rare. Bionic includes a single guard page by default which is\nall that's required for this to work.\n\nWithout this feature, even \"correct\" code can cause a stack overflow\novershooting the guard page. The most significant change is that an\nunbounded alloca can only cause a denial of service since it will\nreliability trigger a segfault. The stack protector feature can only\ncatch buffer overflows past the stack frame boundary, so it provides no\nprotection against these issues.\n\nLLVM only supports this feature on Windows right now where it's a hard\nrequirement of the platform ABI. A more generic version has been\nimplemented but hasn't yet landed.\n\nIn GCC, this feature works well on x86 and x86_64 where there are robust\nplatform-specific implementations, but the generic fallback used on ARM\nand some other architectures is broken:\n\nhttps://gcc.gnu.org/bugzilla/show_bug.cgi?id=65958\n\nBug: 13662332\nChange-Id: Ieae859db44b43547783efe9430d7437621092558","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_platform_ndk/commits/07346b286a804d4003ee00a9c6ff7b745ae21ab5"}]}