From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sun, 6 Jan 2019 02:48:20 +0000 (+0800)
Subject: Remove CC_BOUNDED and use static array subscript for bounds enforcement
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f49b516eac559c8097ef0d33a4ebc3e6a65f084e;p=thirdparty%2Ffreeradius-server.git

Remove CC_BOUNDED and use static array subscript for bounds enforcement

Should work with any compiler supporting C99.
---

diff --git a/configure b/configure
index ca19724e5d6..73fb4f6e405 100755
--- a/configure
+++ b/configure
@@ -2472,8 +2472,6 @@ ac_config_headers="$ac_config_headers src/include/autoconf.h"
 
 
 
-
-
 
 
 
@@ -13067,54 +13065,7 @@ $as_echo "#define HAVE_BUILTIN_BSWAP_64 1" >>confdefs.h
 
 fi
 
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for __attribute__((__bounded__)) support in compiler" >&5
-$as_echo_n "checking for __attribute__((__bounded__)) support in compiler... " >&6; }
-if ${ax_cv_cc_bounded_attribute+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-
-  CFLAGS_SAVED=$CFLAGS
-  CFLAGS="$CFLAGS -Werror"
-  if test "$cross_compiling" = yes; then :
-  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot run test program while cross compiling
-See \`config.log' for more details" "$LINENO" 5; }
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-
-        void test(char *buff) __attribute__ ((__bounded__ (__string__, 1, 1)));
-        int main(int argc, char **argv) {
-          if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */
-          return 0;
-        }
-
-
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-  ax_cv_cc_bounded_attribute=yes
-else
-  ax_cv_cc_bounded_attribute=no
-
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-  CFLAGS="$CFLAGS_SAVED"
-
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_cc_bounded_attribute" >&5
-$as_echo "$ax_cv_cc_bounded_attribute" >&6; }
-if test "x$ax_cv_cc_bounded_attribute" = "xyes"; then
-
-$as_echo "#define HAVE_ATTRIBUTE_BOUNDED 1" >>confdefs.h
-
-fi
-
+AX_CC_HAVE_BOUNDED_ATTRIBUTE
 
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _Generic support in compiler" >&5
diff --git a/m4/ax_cc.m4 b/m4/ax_cc.m4
index c26937388d8..e230e670d64 100644
--- a/m4/ax_cc.m4
+++ b/m4/ax_cc.m4
@@ -311,33 +311,6 @@ if test "x$ax_cv_cc_builtin_bswap64" = "xyes"; then
 fi
 ])
 
-dnl #
-dnl #  Check if we have __attribute__((__bounded__)) (usually only OpenBSD with GCC)
-dnl #
-AC_DEFUN([AX_CC_HAVE_BOUNDED_ATTRIBUTE],[
-AC_CACHE_CHECK([for __attribute__((__bounded__)) support in compiler], [ax_cv_cc_bounded_attribute],[
-  CFLAGS_SAVED=$CFLAGS
-  CFLAGS="$CFLAGS -Werror"
-  AC_RUN_IFELSE(
-    [
-      AC_LANG_SOURCE([
-        void test(char *buff) __attribute__ ((__bounded__ (__string__, 1, 1)));
-        int main(int argc, char **argv) {
-          if ((argc < 0) || !argv) return 1; /* -Werror=unused-parameter */
-          return 0;
-        }
-      ])
-    ],
-    [ax_cv_cc_bounded_attribute=yes],
-    [ax_cv_cc_bounded_attribute=no]
-  )
-  CFLAGS="$CFLAGS_SAVED"
-])
-if test "x$ax_cv_cc_bounded_attribute" = "xyes"; then
-  AC_DEFINE(HAVE_ATTRIBUTE_BOUNDED, 1, [Define if your compiler supports the __bounded__ attribute (usually OpenBSD gcc).])
-fi
-])
-
 dnl #
 dnl # Determine the number of system cores we have
 dnl #
diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
index 336dac8eb70..139e61858fc 100644
--- a/src/include/autoconf.h.in
+++ b/src/include/autoconf.h.in
@@ -35,10 +35,6 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 
-/* Define if your compiler supports the __bounded__ attribute (usually OpenBSD
-   gcc). */
-#undef HAVE_ATTRIBUTE_BOUNDED
-
 /* Define to 1 if you have the `bindat' function. */
 #undef HAVE_BINDAT
 
diff --git a/src/include/build.h b/src/include/build.h
index 3152693bf84..6ec6180e260 100644
--- a/src/include/build.h
+++ b/src/include/build.h
@@ -99,12 +99,6 @@ extern "C" {
 #  define unlikely(_x)	_x
 #endif
 
-#ifdef HAVE_ATTRIBUTE_BOUNDED
-#  define CC_BOUNDED(_x, ...) CC_HINT(__bounded__(_x, ## __VA_ARGS__))
-#else
-#  define CC_BOUNDED(...)
-#endif
-
 /*
  *	Macros to add pragmas
  */
diff --git a/src/lib/server/cf_file.c b/src/lib/server/cf_file.c
index 8f8aecac946..74f89083150 100644
--- a/src/lib/server/cf_file.c
+++ b/src/lib/server/cf_file.c
@@ -73,7 +73,8 @@ static const FR_NAME_NUMBER conf_property_name[] = {
 	{  NULL , -1 }
 };
 
-static int cf_file_include(CONF_SECTION *cs, char const *filename_in, CONF_INCLUDE_TYPE file_type, char *buff[7], bool from_dir);
+static int cf_file_include(CONF_SECTION *cs, char const *filename_in, CONF_INCLUDE_TYPE file_type,
+			   char *buff[static 7], bool from_dir);
 
 /*
  *	Expand the variables in an input string.
diff --git a/src/lib/server/util.c b/src/lib/server/util.c
index f84c1077f86..f3ae13d9d36 100644
--- a/src/lib/server/util.c
+++ b/src/lib/server/util.c
@@ -840,7 +840,7 @@ char const *rad_default_radacct_dir(void)
  * @param mode to convert.
  * @param out Where to write the string to, must be exactly 10 bytes long.
  */
-void rad_mode_to_str(char out[10], mode_t mode)
+void rad_mode_to_str(char out[static 10], mode_t mode)
 {
 	static char const *rwx[] = {"---", "--x", "-w-", "-wx", "r--", "r-x", "rw-", "rwx"};
 
@@ -853,7 +853,7 @@ void rad_mode_to_str(char out[10], mode_t mode)
 	out[9] = '\0';
 }
 
-void rad_mode_to_oct(char out[5], mode_t mode)
+void rad_mode_to_oct(char out[static 5], mode_t mode)
 {
 	out[0] = '0' + ((mode >> 9) & 0x07);
 	out[1] = '0' + ((mode >> 6) & 0x07);
diff --git a/src/lib/server/util.h b/src/lib/server/util.h
index d6cbad141a9..76182c39644 100644
--- a/src/lib/server/util.h
+++ b/src/lib/server/util.h
@@ -57,8 +57,8 @@ char const	*rad_default_run_dir(void);
 char const	*rad_default_sbin_dir(void);
 char const	*rad_default_radacct_dir(void);
 
-void		rad_mode_to_str(char out[10], mode_t mode);
-void		rad_mode_to_oct(char out[5], mode_t mode);
+void		rad_mode_to_str(char out[static 10], mode_t mode);
+void		rad_mode_to_oct(char out[static 5], mode_t mode);
 int		rad_getpwuid(TALLOC_CTX *ctx, struct passwd **out, uid_t uid);
 int		rad_getpwnam(TALLOC_CTX *ctx, struct passwd **out, char const *name);
 int		rad_getgrgid(TALLOC_CTX *ctx, struct group **out, gid_t gid);
diff --git a/src/lib/sim/base.h b/src/lib/sim/base.h
index d6b738158c6..c06cd8b9e0a 100644
--- a/src/lib/sim/base.h
+++ b/src/lib/sim/base.h
@@ -288,9 +288,7 @@ int		fr_sim_vector_umts_from_attrs(eap_session_t *eap_session, VALUE_PAIR *vps,
 /*
  *	fips186prf.c
  */
-void		fr_sim_fips186_2prf(uint8_t out[160], uint8_t mk[20])
-				    CC_BOUNDED(__size__, 2, 160, 160)
-				    CC_BOUNDED(__size__, 1, 20, 20);
+void		fr_sim_fips186_2prf(uint8_t out[static 160], uint8_t mk[static 20]);
 
 /*
  *	xlat.c
diff --git a/src/lib/sim/comp128.c b/src/lib/sim/comp128.c
index 47d66dec90f..52b176f559a 100644
--- a/src/lib/sim/comp128.c
+++ b/src/lib/sim/comp128.c
@@ -238,7 +238,8 @@ static inline void _comp128_permutation(uint8_t *x, uint8_t *bits)
  * @param[in] ki	known only by the SIM and AuC (us in this case).
  * @param[in] rand	16 bytes of randomness.
  */
-void comp128v1(uint8_t sres[4], uint8_t kc[8], uint8_t const ki[16], uint8_t const rand[16])
+void comp128v1(uint8_t sres[static 4], uint8_t kc[static 8],
+	       uint8_t const ki[static 16], uint8_t const rand[static 16])
 {
 	int i;
 	uint8_t x[32], bits[128];
@@ -332,7 +333,8 @@ static void _comp128v23(uint8_t *rand, uint8_t const *kxor)
  * @param[in] rand	16 bytes of randomness.
  * @param[in] v2	if true we use version comp128-2 else we use comp128-3.
  */
-void comp128v23(uint8_t sres[4], uint8_t kc[8], uint8_t const ki[16], uint8_t const rand[16], bool v2)
+void comp128v23(uint8_t sres[static 4], uint8_t kc[static 8],
+		uint8_t const ki[static 16], uint8_t const rand[static 16], bool v2)
 {
 	uint8_t k_mix[16];
 	uint8_t rand_mix[16];
diff --git a/src/lib/sim/comp128.h b/src/lib/sim/comp128.h
index b7da8023be0..698724d367f 100644
--- a/src/lib/sim/comp128.h
+++ b/src/lib/sim/comp128.h
@@ -30,5 +30,5 @@
 #include <stdint.h>
 #include <stdbool.h>
 
-void comp128v1(uint8_t sres[4], uint8_t kc[8], uint8_t const ki[16], uint8_t const rand[16]);
-void comp128v23(uint8_t sres[4], uint8_t kc[8], uint8_t const ki[16], uint8_t const rand[16], bool v2);
+void comp128v1(uint8_t sres[static 4], uint8_t kc[static 8], uint8_t const ki[static 16], uint8_t const rand[static 16]);
+void comp128v23(uint8_t sres[static 4], uint8_t kc[static 8], uint8_t const ki[static 16], uint8_t const rand[static 16], bool v2);
diff --git a/src/lib/sim/fips186prf.c b/src/lib/sim/fips186prf.c
index 6115419de8e..3cca1a4beba 100644
--- a/src/lib/sim/fips186prf.c
+++ b/src/lib/sim/fips186prf.c
@@ -88,7 +88,7 @@ static void onesixty_add_mod(onesixty *sum, onesixty *a, onesixty *b)
  * @param[in] mk	The master key we use to derive all other keying
  *			data.
  */
-void fr_sim_fips186_2prf(uint8_t out[160], uint8_t mk[20])
+void fr_sim_fips186_2prf(uint8_t out[static 160], uint8_t mk[static 20])
 {
 	fr_sha1_ctx	context;
 	int		j;
diff --git a/src/lib/sim/milenage.h b/src/lib/sim/milenage.h
index 64689703599..e6aa9c208b7 100644
--- a/src/lib/sim/milenage.h
+++ b/src/lib/sim/milenage.h
@@ -55,7 +55,7 @@
  * @param[in] i		integer value.
  * @return pointer to out.
  */
-static inline uint8_t *uint48_to_buff(uint8_t out[6], uint64_t i)
+static inline uint8_t *uint48_to_buff(uint8_t out[static 6], uint64_t i)
 {
 	out[0] = (i & 0xff0000000000) >> 40;
 	out[1] = (i & 0x00ff00000000) >> 32;
diff --git a/src/lib/util/hmac_md5.c b/src/lib/util/hmac_md5.c
index 1d468da05ac..789f2094024 100644
--- a/src/lib/util/hmac_md5.c
+++ b/src/lib/util/hmac_md5.c
@@ -47,13 +47,13 @@ static void _hmac_md5_ctx_free_on_exit(void *arg)
 /** Calculate HMAC using OpenSSL's MD5 implementation
  *
  * @param digest Caller digest to be filled in.
- * @param text Pointer to data stream.
- * @param text_len length of data stream.
+ * @param in Pointer to data stream.
+ * @param inlen length of data stream.
  * @param key Pointer to authentication key.
  * @param key_len Length of authentication key.
  *
  */
-void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
+void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *in, size_t inlen,
 		 uint8_t const *key, size_t key_len)
 {
 	HMAC_CTX *ctx;
@@ -72,7 +72,7 @@ void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t
 #endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */
 
 	HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL);
-	HMAC_Update(ctx, text, text_len);
+	HMAC_Update(ctx, in, inlen);
 	HMAC_Final(ctx, digest, NULL);
 	HMAC_CTX_reset(ctx);
 }
@@ -80,16 +80,16 @@ void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t
 /** Calculate HMAC using internal MD5 implementation
  *
  * @param digest Caller digest to be filled in.
- * @param text Pointer to data stream.
- * @param text_len length of data stream.
+ * @param in Pointer to data stream.
+ * @param inlen length of data stream.
  * @param key Pointer to authentication key.
  * @param key_len Length of authentication key.
  *
  */
-void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
+void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *in, size_t inlen,
 		 uint8_t const *key, size_t key_len)
 {
-	FR_MD5_CTX context;
+	FR_MD5_CTX conin;
 	uint8_t k_ipad[65];    /* inner padding - key XORd with ipad */
 	uint8_t k_opad[65];    /* outer padding - key XORd with opad */
 	uint8_t tk[16];
@@ -110,13 +110,13 @@ void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t
 	/*
 	 * the HMAC_MD5 transform looks like:
 	 *
-	 * MD5(K XOR opad, MD5(K XOR ipad, text))
+	 * MD5(K XOR opad, MD5(K XOR ipad, in))
 	 *
 	 * where K is an n byte key
 	 * ipad is the byte 0x36 repeated 64 times
 
 	 * opad is the byte 0x5c repeated 64 times
-	 * and text is the data being protected
+	 * and in is the data being protected
 	 */
 
 	/* start out by storing key in pads */
@@ -133,20 +133,20 @@ void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t
 	/*
 	 * perform inner MD5
 	 */
-	fr_md5_init(&context);		   /* init context for 1st
+	fr_md5_init(&conin);		   /* init conin for 1st
 					      * pass */
-	fr_md5_update(&context, k_ipad, 64);      /* start with inner pad */
-	fr_md5_update(&context, text, text_len); /* then text of datagram */
-	fr_md5_final(digest, &context);	  /* finish up 1st pass */
+	fr_md5_update(&conin, k_ipad, 64);      /* start with inner pad */
+	fr_md5_update(&conin, in, inlen); /* then in of datagram */
+	fr_md5_final(digest, &conin);	  /* finish up 1st pass */
 	/*
 	 * perform outer MD5
 	 */
-	fr_md5_init(&context);		   /* init context for 2nd
+	fr_md5_init(&conin);		   /* init conin for 2nd
 					      * pass */
-	fr_md5_update(&context, k_opad, 64);     /* start with outer pad */
-	fr_md5_update(&context, digest, 16);     /* then results of 1st
+	fr_md5_update(&conin, k_opad, 64);     /* start with outer pad */
+	fr_md5_update(&conin, digest, 16);     /* then results of 1st
 					      * hash */
-	fr_md5_final(digest, &context);	  /* finish up 2nd pass */
+	fr_md5_final(digest, &conin);	  /* finish up 2nd pass */
 }
 #endif /* HAVE_OPENSSL_EVP_H */
 
diff --git a/src/lib/util/inet.c b/src/lib/util/inet.c
index 761f945fd47..f582aea98f7 100644
--- a/src/lib/util/inet.c
+++ b/src/lib/util/inet.c
@@ -976,7 +976,7 @@ char *fr_inet_ifid_ntop(char *out, size_t outlen, uint8_t const *ifid)
  * @param[in] ifid_str to parse.
  * @return a pointer to out.
  */
-uint8_t *fr_inet_ifid_pton(uint8_t out[8], char const *ifid_str)
+uint8_t *fr_inet_ifid_pton(uint8_t out[static 8], char const *ifid_str)
 {
 	static char const xdigits[] = "0123456789abcdef";
 	char const *p, *pch;
diff --git a/src/lib/util/inet.h b/src/lib/util/inet.h
index 8021e0c0bc0..d68bc306a67 100644
--- a/src/lib/util/inet.h
+++ b/src/lib/util/inet.h
@@ -122,7 +122,7 @@ char	*fr_inet_ntop_prefix(char out[FR_IPADDR_PREFIX_STRLEN], size_t outlen, fr_i
 
 char	*fr_inet_ifid_ntop(char *out, size_t outlen, uint8_t const *ifid);
 
-uint8_t	*fr_inet_ifid_pton(uint8_t out[8], char const *ifid_str);
+uint8_t	*fr_inet_ifid_pton(uint8_t out[static 8], char const *ifid_str);
 
 /*
  *	if_index and if_name resolution
diff --git a/src/lib/util/md4.c b/src/lib/util/md4.c
index a87ec27cf6e..17bb1c99aec 100644
--- a/src/lib/util/md4.c
+++ b/src/lib/util/md4.c
@@ -237,7 +237,7 @@ void fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx)
  * @param[in] state 16 bytes of data to feed into the hashing function.
  * @param[in,out] block MD4 digest block to update.
  */
-void fr_md4_transform(uint32_t state[4], uint8_t const block[MD4_BLOCK_LENGTH])
+void fr_md4_transform(uint32_t state[static 4], uint8_t const block[static MD4_BLOCK_LENGTH])
 {
 	uint32_t a, b, c, d;
 	uint32_t const *in = (uint32_t const *)block;
diff --git a/src/lib/util/md4.h b/src/lib/util/md4.h
index d997b10b532..943d57acd40 100644
--- a/src/lib/util/md4.h
+++ b/src/lib/util/md4.h
@@ -64,13 +64,9 @@ typedef struct {
 } FR_MD4_CTX;
 
 void	fr_md4_init(FR_MD4_CTX *ctx);
-void	fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen)
-	CC_BOUNDED(__string__, 2, 3);
-void	fr_md4_final(uint8_t out[MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx)
-	CC_BOUNDED(__minbytes__, 1, MD4_DIGEST_LENGTH);
-void	fr_md4_transform(uint32_t buf[4], uint8_t const inc[MD4_BLOCK_LENGTH])
-	CC_BOUNDED(__size__, 1, 4, 4)
-	CC_BOUNDED(__minbytes__, 2, MD4_BLOCK_LENGTH);
+void	fr_md4_update(FR_MD4_CTX *ctx, uint8_t const *in, size_t inlen);
+void	fr_md4_final(uint8_t out[static MD4_DIGEST_LENGTH], FR_MD4_CTX *ctx)
+void	fr_md4_transform(uint32_t buf[static 4], uint8_t const inc[static MD4_BLOCK_LENGTH]);
 #else  /* HAVE_OPENSSL_EVP_H */
 USES_APPLE_DEPRECATED_API
 #include <openssl/md4.h>
@@ -82,7 +78,7 @@ USES_APPLE_DEPRECATED_API
 #endif
 
 /* md4.c */
-void fr_md4_calc(uint8_t out[MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen);
+void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen);
 
 #ifdef __cplusplus
 }
diff --git a/src/lib/util/md5.c b/src/lib/util/md5.c
index 4c81bbad087..3583c1a1e9e 100644
--- a/src/lib/util/md5.c
+++ b/src/lib/util/md5.c
@@ -18,7 +18,7 @@ RCSID("$Id$")
  * @param[in] in Data to hash.
  * @param[in] inlen Length of the data.
  */
-void fr_md5_calc(uint8_t *out, uint8_t const *in, size_t inlen)
+void fr_md5_calc(uint8_t out[static MD5_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
 {
 	FR_MD5_CTX ctx;
 
@@ -177,7 +177,7 @@ void fr_md5_final(uint8_t out[MD5_DIGEST_LENGTH], FR_MD5_CTX *ctx)
  * @param[in] state 16 bytes of data to feed into the hashing function.
  * @param[in,out] block MD5 digest block to update.
  */
-void fr_md5_transform(uint32_t state[4], uint8_t const block[MD5_BLOCK_LENGTH])
+void fr_md5_transform(uint32_t state[static 4], uint8_t const block[static MD5_BLOCK_LENGTH])
 {
 	uint32_t a, b, c, d, in[MD5_BLOCK_LENGTH / 4];
 
diff --git a/src/lib/util/md5.h b/src/lib/util/md5.h
index 345e8eb8f6f..62ba1340a25 100644
--- a/src/lib/util/md5.h
+++ b/src/lib/util/md5.h
@@ -59,13 +59,9 @@ typedef struct {
 } FR_MD5_CTX;
 
 void 	fr_md5_init(FR_MD5_CTX *ctx);
-void	fr_md5_update(FR_MD5_CTX *ctx, uint8_t const *in, size_t inlen)
-	CC_BOUNDED(__string__, 2, 3);
-void	fr_md5_final(uint8_t out[MD5_DIGEST_LENGTH], FR_MD5_CTX *ctx)
-	CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH);
-void	fr_md5_transform(uint32_t state[4], uint8_t const block[MD5_BLOCK_LENGTH])
-	CC_BOUNDED(__size__, 1, 4, 4)
-	CC_BOUNDED(__minbytes__, 2, MD5_BLOCK_LENGTH);
+void	fr_md5_update(FR_MD5_CTX *ctx, uint8_t const *in, size_t inlen);
+void	fr_md5_final(uint8_t out[static MD5_DIGEST_LENGTH], FR_MD5_CTX *ctx);
+void	fr_md5_transform(uint32_t state[static 4], uint8_t const block[static MD5_BLOCK_LENGTH]);
 #  define fr_md5_copy(_out, _in)	memcpy(_out, _in, sizeof(*_out))
 #else  /* HAVE_OPENSSL_EVP_H */
 USES_APPLE_DEPRECATED_API
@@ -79,12 +75,10 @@ USES_APPLE_DEPRECATED_API
 #endif
 
 /* hmac.c */
-void	fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
-		    uint8_t const *key, size_t key_len)
-	CC_BOUNDED(__minbytes__, 1, MD5_DIGEST_LENGTH);
-
+void	fr_hmac_md5(uint8_t digest[static MD5_DIGEST_LENGTH], uint8_t const *in, size_t inlen,
+		    uint8_t const *key, size_t key_len);
 /* md5.c */
-void	fr_md5_calc(uint8_t *out, uint8_t const *in, size_t inlen);
+void	fr_md5_calc(uint8_t out[static MD5_DIGEST_LENGTH], uint8_t const *in, size_t inlen);
 
 #ifdef __cplusplus
 }
diff --git a/src/lib/util/pair.h b/src/lib/util/pair.h
index a3cefbcc391..d96dc127882 100644
--- a/src/lib/util/pair.h
+++ b/src/lib/util/pair.h
@@ -318,7 +318,7 @@ void		fr_pair_value_snprintf(VALUE_PAIR *vp, char const *fmt, ...) CC_HINT(forma
 /* Printing functions */
 size_t   	fr_pair_value_snprint(char *out, size_t outlen, VALUE_PAIR const *vp, char quote);
 char     	*fr_pair_value_asprint(TALLOC_CTX *ctx, VALUE_PAIR const *vp, char quote);
-char const	*fr_pair_value_enum(VALUE_PAIR const *vp, char buff[20]);
+char const	*fr_pair_value_enum(VALUE_PAIR const *vp, char buff[static 20]);
 
 size_t		fr_pair_snprint(char *out, size_t outlen, VALUE_PAIR const *vp);
 void		fr_pair_fprint(FILE *, VALUE_PAIR const *vp);
diff --git a/src/lib/util/sha1.c b/src/lib/util/sha1.c
index 76f336bafe1..f9d0601dfe4 100644
--- a/src/lib/util/sha1.c
+++ b/src/lib/util/sha1.c
@@ -33,7 +33,7 @@ RCSID("$Id$")
 
 /* Hash a single 512-bit block. This is the core of the algorithm. */
 
-void fr_sha1_transform(uint32_t state[5], uint8_t const buffer[64])
+void fr_sha1_transform(uint32_t state[static 5], uint8_t const buffer[static 64])
 {
 	uint32_t a, b, c, d, e;
 	typedef union {
@@ -129,7 +129,7 @@ void fr_sha1_update(fr_sha1_ctx *context,uint8_t const *data, size_t len)
 
 /* Add padding and return the message digest. */
 
-void fr_sha1_final(uint8_t digest[20], fr_sha1_ctx *context)
+void fr_sha1_final(uint8_t digest[static 20], fr_sha1_ctx *context)
 {
 	uint32_t i, j;
 	uint8_t finalcount[8];
@@ -162,7 +162,7 @@ void fr_sha1_final(uint8_t digest[20], fr_sha1_ctx *context)
 #  endif
 }
 
-void fr_sha1_final_no_len(uint8_t digest[20], fr_sha1_ctx *context)
+void fr_sha1_final_no_len(uint8_t digest[static 20], fr_sha1_ctx *context)
 {
 	uint32_t i, j;
 
diff --git a/src/lib/util/sha1.h b/src/lib/util/sha1.h
index 8856a811acb..ce6cbe0a544 100644
--- a/src/lib/util/sha1.h
+++ b/src/lib/util/sha1.h
@@ -35,16 +35,16 @@ typedef struct {
     uint8_t buffer[64];
 } fr_sha1_ctx;
 
-void fr_sha1_transform(uint32_t state[5], uint8_t const buffer[64]);
+void fr_sha1_transform(uint32_t state[static 5], uint8_t const buffer[static 64]);
 void fr_sha1_init(fr_sha1_ctx *context);
 void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *data, size_t len);
-void fr_sha1_final(uint8_t digest[20], fr_sha1_ctx *context);
+void fr_sha1_final(uint8_t digest[static 20], fr_sha1_ctx *context);
 
 /*
  * this version implements a raw SHA1 transform, no length is appended,
  * nor any 128s out to the block size.
  */
-void fr_sha1_final_no_len(uint8_t digest[20], fr_sha1_ctx* context);
+void fr_sha1_final_no_len(uint8_t digest[static 20], fr_sha1_ctx* context);
 
 #else  /* WITH_OPENSSL_SHA1 */
 USES_APPLE_DEPRECATED_API
diff --git a/src/protocols/dhcpv4/dhcpv4.h b/src/protocols/dhcpv4/dhcpv4.h
index be19b61a012..1ec9ee3fc65 100644
--- a/src/protocols/dhcpv4/dhcpv4.h
+++ b/src/protocols/dhcpv4/dhcpv4.h
@@ -196,7 +196,8 @@ int		fr_dhcpv4_pcap_send(fr_pcap_t *pcap, uint8_t *dst_ether_addr, RADIUS_PACKET
 /*
  *	udp.c
  */
-int		fr_dhcpv4_udp_add_arp_entry(int fd, char const *interface, fr_ipaddr_t const *ip, uint8_t macaddr[6]);
+int		fr_dhcpv4_udp_add_arp_entry(int fd, char const *interface,
+					    fr_ipaddr_t const *ip, uint8_t macaddr[static 6]);
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/protocols/dhcpv4/udp.c b/src/protocols/dhcpv4/udp.c
index 92b1b6a0121..fd653468dd8 100644
--- a/src/protocols/dhcpv4/udp.c
+++ b/src/protocols/dhcpv4/udp.c
@@ -67,7 +67,7 @@
  *	- 0 on success.
  *	- -1 on failure.
  */
-int fr_dhcpv4_udp_add_arp_entry(int fd, char const *interface, fr_ipaddr_t const *ip, uint8_t macaddr[6])
+int fr_dhcpv4_udp_add_arp_entry(int fd, char const *interface, fr_ipaddr_t const *ip, uint8_t macaddr[static 6])
 {
 	struct sockaddr_in *sin;
 	struct arpreq req;
@@ -96,7 +96,7 @@ int fr_dhcpv4_udp_add_arp_entry(int fd, char const *interface, fr_ipaddr_t const
 }
 #else
 int fr_dhcpv4_udp_add_arp_entry(UNUSED int fd, UNUSED char const *interface,
-				UNUSED fr_ipaddr_t const *ip, UNUSED uint8_t macaddr[6])
+				UNUSED fr_ipaddr_t const *ip, UNUSED uint8_t macaddr[static 6])
 {
 	fr_strerror_printf("Adding ARP entry is unsupported on this system");
 	return -1;