zmodem wrote:
> @zmodem Compatibility with MSVC makes clang cl as secure (without over
> protection) as MSVC. May I ask if there are any known security risks on the
> Windows platform caused by compiling with MSVC, and if compiling with clang
> cl can avoid them?
Yes, `clang-cl /GS` will currently protect `f()` against stack smashing in case
`g()` writes too far:
```
void g(int* p);
int f() {
int x;
g(&x);
return x;
}
```
MSVC will not protect against this, and IIUC after your patch neither would
clang-cl. That's a security risk, right?
I'm not saying we shouldn't do this, but reducing the protection level of an
existing flag makes me pretty nervous.
https://github.com/llvm/llvm-project/pull/225626
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
