diff --git a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md index b1f6344b..f4b29d22 100644 --- a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md +++ b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md @@ -42,7 +42,7 @@ When compiling C or C++ code on compilers such as GCC and clang, turn on these f | for x86_64 | `-fcf-protection=full` | | for aarch64 | `-mbranch-protection=standard` | | for production code | `-fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero` | -| for treating obsolete C constructs as errors | `-Werror=implicit -Werror=incompatible-pointer-types -Werror=int-conversion` | +| for C code treating obsolete C constructs as errors | `-Werror=implicit -Werror=incompatible-pointer-types -Werror=int-conversion` | | for multi-threaded C code using GNU C library pthreads | `-fexceptions` | | during development but *not* when distributing source | `-Werror` | @@ -490,15 +490,15 @@ Some Linux distributions, such as Arch Linux[^arch-buildflags], Fedora[^fedora-f ### Treat obsolete C constructs as errors -| Compiler Flag | Supported since | Description | -|:----------------------------------------------------------------------------------------- |:--------------------------:|:-------------------------------------------------------------------------------------------------| +| Compiler Flag | Supported since | Description | +|:----------------------------------------------------------------------------------------- |:----------------------------:|:-------------------------------------------------------------------------------------------------| | `-Werror=implicit` | GCC 2.95.3
 Clang 2.6.0 | Treat declarations that do not specify as type or functions used before being declared as errors | -| `-Werror=incompatible-pointer-types` | GCC 5.5.0
 Clang 7.0.0 | Treat conversion between pointers that have incompatible types as errors | -| `-Werror=int-conversion` | GCC 2.95.3
 Clang 2.6.0 | Treat implicit integer to pointer and pointer to integer conversions as errors | +| `-Werror=incompatible-pointer-types` | GCC 5.1.0
 Clang 7.0.0 | Treat conversion between pointers that have incompatible types as errors | +| `-Werror=int-conversion` | GCC 5.1.0
 Clang 2.6.0 | Treat implicit integer to pointer and pointer to integer conversions as errors | #### Synopsis -Make the compiler treat obsolete C constructs as errors. +Make the compiler treat obsolete C constructs as errors. These options are relevant for C code only. The ISO/IEC 9899:1999 standard, commonly referred to as C99, removed several backwards compatibility features, such as implicit function declarations and implicit return types from the C language. Similarly, the earlier C89/C90 standard (ANSI X3.159-1989 / ISO/IEC 9899:1990) removed certain implicit type conversion, such as implicit conversions from integer to pointer types. Such implicit declarations[^DCL31-C] and type conversions (whether implicit or explicit[^INT36-C]) can be considered dangerous for the correctness and security of C code as they lead to less stringent type checking and may rely on implementation-defined behavior. However, modern compilers still accept these obsolete constructs by default unless instructed to pedantically give errors whenever the base standard requires them. @@ -516,6 +516,10 @@ Note that the list of options indicated here do not capture a complete list of r Some tools, such as `autoconf`, automatically determine what the compiler supports by generating code and compiling it. Old versions of these tools may not use more modern practices internally, so enabling errors can cause spurious reports that some functionality isn't available. The best solution is to update the tool. Where that isn't an option, consider adding `-Werror` forms *after* the tool has determined the mechanisms supported by the compiler. +#### Additional Considerations + +Clang and GCC 5.1 - 8.3 allow these options to be specified when compiling C++ code although they will not have any effect as these constructs are already illegal in C++. GCC 8.4 and later will warn these options are not valid for C++. + [^DCL31-C]: Carnegie Mellon University (CMU), [DCL31-C. Declare identifiers before using them](https://wiki.sei.cmu.edu/confluence/display/c/DCL31-C.+Declare+identifiers+before+using+them), SEI CERT C Coding Standard, 2023-10-09. [^INT36-C]: Carnegie Mellon University (CMU), [INT36-C. Converting a pointer to integer or integer to pointer](https://wiki.sei.cmu.edu/confluence/display/c/INT36-C.+Converting+a+pointer+to+integer+or+integer+to+pointer), SEI CERT C Coding Standard, 2023-04-20.