https://github.com/python/cpython/commit/7fb32e02092922b0256d7be91bbf80767eb2ca46
commit: 7fb32e02092922b0256d7be91bbf80767eb2ca46
branch: main
author: Nate Ohlson <[email protected]>
committer: corona10 <[email protected]>
date: 2024-06-26T12:11:05+09:00
summary:
gh-112301: Enable compiler flags with low performance impact and no warnings
(gh-120975)
files:
A Misc/NEWS.d/next/Security/2024-06-25-04-42-43.gh-issue-112301.god4IC.rst
M configure
M configure.ac
diff --git
a/Misc/NEWS.d/next/Security/2024-06-25-04-42-43.gh-issue-112301.god4IC.rst
b/Misc/NEWS.d/next/Security/2024-06-25-04-42-43.gh-issue-112301.god4IC.rst
new file mode 100644
index 00000000000000..68058a06f0bf49
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-06-25-04-42-43.gh-issue-112301.god4IC.rst
@@ -0,0 +1,2 @@
+Add default compiler options to improve security. Enable
+-Wimplicit-fallthrough, -fstack-protector-strong, -Wtrampolines.
diff --git a/configure b/configure
index 823d5a2cc81ee5..aa32043eefbafe 100755
--- a/configure
+++ b/configure
@@ -9605,6 +9605,130 @@ else $as_nop
BASECFLAGS="$BASECFLAGS $NO_STRICT_OVERFLOW_CFLAGS"
fi
+# Enable flags that warn and protect for potential security vulnerabilities.
+# These flags should be enabled by default for all builds.
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler
accepts -Wimplicit-fallthrough" >&5
+printf %s "checking whether C compiler accepts -Wimplicit-fallthrough... "
>&6; }
+if test ${ax_cv_check_cflags___Wimplicit_fallthrough+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+
+ ax_check_save_flags=$CFLAGS
+ CFLAGS="$CFLAGS -Wimplicit-fallthrough"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+int
+main (void)
+{
+
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+ ax_cv_check_cflags___Wimplicit_fallthrough=yes
+else $as_nop
+ ax_cv_check_cflags___Wimplicit_fallthrough=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result:
$ax_cv_check_cflags___Wimplicit_fallthrough" >&5
+printf "%s\n" "$ax_cv_check_cflags___Wimplicit_fallthrough" >&6; }
+if test "x$ax_cv_check_cflags___Wimplicit_fallthrough" = xyes
+then :
+ BASECFLAGS="$BASECFLAGS -Wimplicit-fallthrough"
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING:
-Wimplicit-fallthrough not supported" >&5
+printf "%s\n" "$as_me: WARNING: -Wimplicit-fallthrough not supported" >&2;}
+fi
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler
accepts -fstack-protector-strong" >&5
+printf %s "checking whether C compiler accepts -fstack-protector-strong... "
>&6; }
+if test ${ax_cv_check_cflags___fstack_protector_strong+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+
+ ax_check_save_flags=$CFLAGS
+ CFLAGS="$CFLAGS -fstack-protector-strong"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+int
+main (void)
+{
+
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+ ax_cv_check_cflags___fstack_protector_strong=yes
+else $as_nop
+ ax_cv_check_cflags___fstack_protector_strong=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result:
$ax_cv_check_cflags___fstack_protector_strong" >&5
+printf "%s\n" "$ax_cv_check_cflags___fstack_protector_strong" >&6; }
+if test "x$ax_cv_check_cflags___fstack_protector_strong" = xyes
+then :
+ BASECFLAGS="$BASECFLAGS -fstack-protector-strong"
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING:
-fstack-protector-strong not supported" >&5
+printf "%s\n" "$as_me: WARNING: -fstack-protector-strong not supported" >&2;}
+fi
+
+case $CC in
+ *gcc*)
+ # Add GCC-specific compiler flags
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler
accepts -Wtrampolines" >&5
+printf %s "checking whether C compiler accepts -Wtrampolines... " >&6; }
+if test ${ax_cv_check_cflags___Wtrampolines+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+
+ ax_check_save_flags=$CFLAGS
+ CFLAGS="$CFLAGS -Wtrampolines"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+int
+main (void)
+{
+
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+ ax_cv_check_cflags___Wtrampolines=yes
+else $as_nop
+ ax_cv_check_cflags___Wtrampolines=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result:
$ax_cv_check_cflags___Wtrampolines" >&5
+printf "%s\n" "$ax_cv_check_cflags___Wtrampolines" >&6; }
+if test "x$ax_cv_check_cflags___Wtrampolines" = xyes
+then :
+ BASECFLAGS="$BASECFLAGS -Wtrampolines"
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: -Wtrampolines not
supported" >&5
+printf "%s\n" "$as_me: WARNING: -Wtrampolines not supported" >&2;}
+fi
+
+esac
+
case $GCC in
yes)
CFLAGS_NODIST="$CFLAGS_NODIST -std=c11"
diff --git a/configure.ac b/configure.ac
index 619dad56ffe190..e5c6d6f130f672 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2451,6 +2451,16 @@ AS_VAR_IF([with_strict_overflow], [yes],
[BASECFLAGS="$BASECFLAGS $STRICT_OVERFLOW_CFLAGS"],
[BASECFLAGS="$BASECFLAGS $NO_STRICT_OVERFLOW_CFLAGS"])
+# Enable flags that warn and protect for potential security vulnerabilities.
+# These flags should be enabled by default for all builds.
+AX_CHECK_COMPILE_FLAG([-Wimplicit-fallthrough], [BASECFLAGS="$BASECFLAGS
-Wimplicit-fallthrough"], [AC_MSG_WARN([-Wimplicit-fallthrough not supported])])
+AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [BASECFLAGS="$BASECFLAGS
-fstack-protector-strong"], [AC_MSG_WARN([-fstack-protector-strong not
supported])])
+case $CC in
+ *gcc*)
+ # Add GCC-specific compiler flags
+ AX_CHECK_COMPILE_FLAG([-Wtrampolines], [BASECFLAGS="$BASECFLAGS
-Wtrampolines"], [AC_MSG_WARN([-Wtrampolines not supported])])
+esac
+
case $GCC in
yes)
CFLAGS_NODIST="$CFLAGS_NODIST -std=c11"
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
