From cee4dc61015d31d27ca25ccb2a7226493f486cd5 Mon Sep 17 00:00:00 2001 From: Sebastian Hahn Date: Tue, 19 Oct 2010 19:14:58 +0200 Subject: [PATCH 1/3] Use ssp-buffer-size param when hardening We used to enable ssp-buffer-size=1 only when building with --enable-gcc-warnings. That would result in warnings (and no protection for small arrays) when building with --enable-gcc-hardening without enabling warnings, too. Fixes bug 2031. Also remove an XXX: We now allow to build with -fstack-protector by using --enable-gcc-hardening. --- changes/bug2031 | 5 +++++ configure.in | 5 ++--- 2 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 changes/bug2031 diff --git a/changes/bug2031 b/changes/bug2031 new file mode 100644 index 0000000000..59afc022e1 --- /dev/null +++ b/changes/bug2031 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Enable protection of small arrays whenever we build with gcc hardening + features, not only when also building with warnings enabled. Fixes bug + 2031; bugfix on 0.2.2.14-alpha. Reported by keb. + diff --git a/configure.in b/configure.in index 891daa82c1..7e72adaa33 100644 --- a/configure.in +++ b/configure.in @@ -99,7 +99,7 @@ AC_ARG_ENABLE(gcc-hardening, [if test x$enableval = xyes; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector -Wformat -Wformat-security" - CFLAGS="$CFLAGS -Wpointer-sign" + CFLAGS="$CFLAGS -Wpointer-sign --param ssp-buffer-size=1" LDFLAGS="$LDFLAGS -pie" fi]) @@ -892,9 +892,8 @@ if test x$enable_gcc_warnings = xyes || test x$enable_gcc_warnings_advisory = xy if test x$have_gcc42 = xyes ; then # These warnings break gcc 4.0.2 and work on gcc 4.2 - # XXXX020 Use -fstack-protector. # XXXX020 See if any of these work with earlier versions. - CFLAGS="$CFLAGS -Waddress -Wmissing-noreturn -Wnormalized=id -Woverride-init -Wstrict-overflow=1 --param ssp-buffer-size=1" + CFLAGS="$CFLAGS -Waddress -Wmissing-noreturn -Wnormalized=id -Woverride-init -Wstrict-overflow=1" # We used to use -Wstrict-overflow=5, but that breaks us heavily under 4.3. fi From 12d675a8dd9e1288c60db2107be269022c2ae4d4 Mon Sep 17 00:00:00 2001 From: Sebastian Hahn Date: Wed, 20 Oct 2010 12:47:09 +0200 Subject: [PATCH 2/3] Remove redundant -Wformat -Wformat-security CFLAGS When configuring with --enable-gcc-warnings, we use -Wformat=2 which automatically enables the available -Wformat switches, so adding them again in the --enable-gcc-hardening case doesn't make sense.. --- configure.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.in b/configure.in index 7e72adaa33..ef358a8085 100644 --- a/configure.in +++ b/configure.in @@ -98,7 +98,7 @@ AC_ARG_ENABLE(gcc-hardening, AS_HELP_STRING(--enable-gcc-hardening, enable compiler security checks), [if test x$enableval = xyes; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" - CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector -Wformat -Wformat-security" + CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector" CFLAGS="$CFLAGS -Wpointer-sign --param ssp-buffer-size=1" LDFLAGS="$LDFLAGS -pie" fi]) From 4f0badf974e05360d57926ddbd73677e5d3a5557 Mon Sep 17 00:00:00 2001 From: Sebastian Hahn Date: Wed, 20 Oct 2010 13:01:30 +0200 Subject: [PATCH 3/3] Remove redundant -Wpointer-sign CFLAG -Wpointer-sign is implied with -Wall, which we use when building with --enable-gcc-warnings. --- configure.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.in b/configure.in index ef358a8085..65e82de7cc 100644 --- a/configure.in +++ b/configure.in @@ -99,7 +99,7 @@ AC_ARG_ENABLE(gcc-hardening, [if test x$enableval = xyes; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector" - CFLAGS="$CFLAGS -Wpointer-sign --param ssp-buffer-size=1" + CFLAGS="$CFLAGS --param ssp-buffer-size=1" LDFLAGS="$LDFLAGS -pie" fi])