From: Christian Brauner Date: Mon, 11 Mar 2019 22:36:02 +0000 (+0100) Subject: compiler: -fexceptions hardening X-Git-Tag: lxc-3.2.0~116^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e74d1fd9f3aa92f80e2ff5d7335158e4d52ab69e;p=thirdparty%2Flxc.git compiler: -fexceptions hardening This hardens multi-threaded C. Without it, the implementation of thread cancellation handlers (introduced by pthread_cleanup_push) uses a completely unprotected function pointer on the stack. This function pointer can simplify the exploitation of stack-based buffer overflows even if the thread in question is never canceled. Signed-off-by: Christian Brauner --- diff --git a/configure.ac b/configure.ac index 28efe43e1..3abee054f 100644 --- a/configure.ac +++ b/configure.ac @@ -721,6 +721,7 @@ AX_CHECK_COMPILE_FLAG([-Wdate-time], [CFLAGS="$CFLAGS -Wdate-time"],,[-Werror]) AX_CHECK_COMPILE_FLAG([-Wnested-externs], [CFLAGS="$CFLAGS -Wnested-externs"],,[-Werror]) AX_CHECK_COMPILE_FLAG([-fasynchronous-unwind-tables], [CFLAGS="$CFLAGS -fasynchronous-unwind-tables"],,[-Werror]) AX_CHECK_COMPILE_FLAG([-pipe], [CFLAGS="$CFLAGS -pipe"],,[-Werror]) +AX_CHECK_COMPILE_FLAG([-fexceptions], [CFLAGS="$CFLAGS -fexceptions"],,[-Werror]) AX_CHECK_LINK_FLAG([-z relro], [LDLAGS="$LDLAGS -z relro"],,[]) AX_CHECK_LINK_FLAG([-z now], [LDLAGS="$LDLAGS -z now"],,[])