Skip to content

Commit 4e57e23

Browse files
author
Philip Kaufmann
committed
enable full GCC Stack-smashing protection for all OSes
- change our hardening options to use -fstack-protector-all even for Windows builds, as we recently switched to a newer compiler suite - also removes an obsolete workaround for GCC 4.5 (https://bugs.launchpad.net/ubuntu/+source/gcc-4.5/+bug/691722), which required to first set -fno-stack-protector, before -fstack-protector-all
1 parent 2f06b59 commit 4e57e23

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

configure.ac

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,7 @@ AX_CHECK_LINK_FLAG([[-Wl,--large-address-aware]], [LDFLAGS="$LDFLAGS -Wl,--large
284284

285285
if test x$use_hardening != xno; then
286286
AX_CHECK_COMPILE_FLAG([-Wstack-protector],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -Wstack-protector"])
287+
AX_CHECK_COMPILE_FLAG([-fstack-protector-all],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fstack-protector-all"])
287288
AX_CHECK_COMPILE_FLAG([-fPIE],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fPIE"])
288289

289290
AX_CHECK_PREPROC_FLAG([-D_FORTIFY_SOURCE=2],[
@@ -299,10 +300,6 @@ if test x$use_hardening != xno; then
299300
AX_CHECK_LINK_FLAG([[-Wl,-z,now]], [LDFLAGS="-Wl,-z,now"])
300301

301302
if test x$TARGET_OS != xwindows; then
302-
# -fstack-protector-all can produce broken binaries with mingw
303-
AX_CHECK_COMPILE_FLAG([-fno-stack-protector],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fno-stack-protector"])
304-
AX_CHECK_COMPILE_FLAG([-fstack-protector-all],[HARDENED_CXXFLAGS="$HARDENED_CXXFLAGS -fstack-protector-all"])
305-
306303
# -pie will link successfully with MinGW, but it's unsupported and leads to undeterministic binaries
307304
AX_CHECK_LINK_FLAG([[-pie]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -pie"])
308305
fi

0 commit comments

Comments
 (0)