You copied the Doc URL to your clipboard.

Arm® Compiler 5 and Arm® Compiler 6 stack protection behavior

You can see which functions are protected and compare Arm® Compiler 5 protection with Arm Compiler 6 protection after migration.


This topic includes descriptions of [COMMUNITY] features. See Support level definitions.

The behavior of armclang -fstack-protector and armclang -fstack-protector-strong is different from the behavior of the armcc --protect_stack option:

  • With armcc --protect_stack, a function is considered vulnerable if it contains a char or wchar_t array of any size.
  • With armclang -fstack-protector, a function is considered vulnerable if it contains at least one of the following:

    • A character (char or 8-bit integer) array larger than 8 bytes.
    • A call to alloca() with either a variable size or a constant size bigger than 8 bytes.
  • With armclang -fstack-protector-strong, a function is considered vulnerable if it contains:

    • An array of any size and type.
    • A call to alloca().
    • A local variable that has its address taken.

    Arm recommends the use of -fstack-protector-strong.


When using Arm Compiler 5, the value of the variable __stack_chk_guard could change during the life of the program. With Arm Compiler 6, a suitable implementation might set this variable to a random value when the program is loaded, before the first protected function is entered. The value must then remain unchanged during the life of the program.


  1. Create the file test.c containing the following code:

    // test.c
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    void *__stack_chk_guard = (void *)0xdeadbeef;
    void __stack_chk_fail(void) {
      printf("Stack smashing detected.\n");
    static void copy(const char *p) {
      char buf[8];
      strcpy(buf, p);
      printf("Copied: %s\n", buf);
    int main(void) {
      const char *t = "Hello World!";
      printf("%s\n", t);
      return 0;
  2. For Arm Compiler 5, search for branches to the __stack_chk_fail() function in the output from the fromelf -c command. The functions containing such branches are protected.

    armcc -c --cpu=7-A --protect_stack test.c -o test.o
    fromelf -c test.o
            0x00000010:    e92d403e    >@-.    PUSH     {r1-r5,lr}
            0x00000014:    e1a04000    .@..    MOV      r4,r0
            0x00000018:    e59f0070    p...    LDR      r0,[pc,#112] ; [__stack_chk_guard = 0x90] = 0
            0x0000001c:    e5905000    .P..    LDR      r5,[r0,#0]
            0x00000020:    e58d5008    .P..    STR      r5,[sp,#8]
            0x00000024:    e1a01004    ....    MOV      r1,r4
            0x00000028:    e1a0000d    ....    MOV      r0,sp
            0x0000002c:    ebfffffe    ....    BL       strcpy
            0x00000030:    e1a0100d    ....    MOV      r1,sp
            0x00000034:    e28f0058    X...    ADR      r0,{pc}+0x60 ; 0x94
            0x00000038:    ebfffffe    ....    BL       __2printf
            0x0000003c:    e59d0008    ....    LDR      r0,[sp,#8]
            0x00000040:    e1500005    ..P.    CMP      r0,r5
            0x00000044:    0a000000    ....    BEQ      {pc}+0x8 ; 0x4c
            0x00000048:    ebfffffe    ....    BL       __stack_chk_fail ; 0x0 Section #1
            0x0000004c:    e8bd803e    >...    POP      {r1-r5,pc}
  3. For Arm Compiler 6, use the armclang [COMMUNITY] -Rpass remark option.

    armclang -c --target=arm-arm-none-eabi -march=armv8-a -O0 -Rpass=stack-protector test.c
    test.c:14:13: remark: Stack protection applied to function copy due to a stack allocated buffer or struct containing a
          buffer [-Rpass=stack-protector]
    static void copy(const char *p) {


    You can also use the fromelf -c command and search the output for functions containing branches to the __stack_chk_fail() function.