Skip to content
This repository has been archived by the owner on Apr 17, 2022. It is now read-only.

fails to build from source with GCC hardening options #3493

Closed
wzdev-ci opened this issue May 19, 2012 · 10 comments
Closed

fails to build from source with GCC hardening options #3493

wzdev-ci opened this issue May 19, 2012 · 10 comments
Labels
closed component: other normal
Milestone
unspecified

Comments

@wzdev-ci
Copy link
Contributor

resolution_fixed type_patch (an actual patch, not a request for one) | by pabs

The attached patch fixes building from source while enabling the GCC hardening options:

CPPFLAGS="-D_FORTIFY_SOURCE=2"
CFLAGS="-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security"
CXXFLAGS="-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security"
LDFLAGS="-fPIE -pie -Wl,-z,relro -Wl,-z,now"

This is how Debian enables these options (other distros turn them on by default in GCC):

https://wiki.debian.org/Hardening

Issue migrated from trac:3493 at 2022-04-16 09:49:59 -0700
@wzdev-ci
Copy link
Contributor Author

dak180 edited the issue description

@wzdev-ci
Copy link
Contributor Author

Cyp commented

I could not apply this patch, as lib/script/script_parser.cpp and src/scriptvals_parser.cpp are autogenerated (and appear in my out-of-main-tree build/ directory).

I have no idea how to apply the patch to the original lib/script/script_parser.ypp and src/scriptvals_parser.ypp files, as the relevant part of the code seems to be just a "%%" in the .ypp files.

@wzdev-ci
Copy link
Contributor Author

pabs uploaded file fix-FTBFS-with-hardening-flags.patch (1.9 KiB)

fix FTBFS with GCC hardening options

@wzdev-ci
Copy link
Contributor Author

pabs commented

Added an updated patch that doesn't patch the generated code (why is it in tarball?). Based on this bug report yyerror (or equivalent) should not be marked with the format attribute:

http://bugs.debian.org/648765

@wzdev-ci
Copy link
Contributor Author

Paul Wise changed status from new to closed

@wzdev-ci
Copy link
Contributor Author

Paul Wise changed resolution from `` to fixed

@wzdev-ci
Copy link
Contributor Author

Paul Wise commented

fix an FTBFS with -Werror=format-security

Fixes #3493.

@wzdev-ci
Copy link
Contributor Author

Paul Wise commented

fix an FTBFS with -Werror=format-security

Fixes #3493.

2 similar comments
@wzdev-ci
Copy link
Contributor Author

Paul Wise commented

fix an FTBFS with -Werror=format-security

Fixes #3493.

@wzdev-ci
Copy link
Contributor Author

wzdev-ci commented Aug 4, 2012

Paul Wise commented

fix an FTBFS with -Werror=format-security

Fixes #3493.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
closed component: other normal
Projects
None yet
Milestone
unspecified
Development

No branches or pull requests
1 participant
@wzdev-ci