gh-112301: Add fortify source level 3 to default compiler options (gh-121520)

nohlson · web-flow · commit bdab67e1c795 · 2024-07-19T01:06:51.000+09:00
diff --git a/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst b/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
@@ -0,0 +1,2 @@
+Enable runtime protections for glibc to abort execution when unsafe behavior is encountered,
+for all platforms except Windows.
diff --git a/configure b/configure
diff --git a/configure.ac b/configure.ac
@@ -2460,6 +2460,7 @@ AS_VAR_IF([with_strict_overflow], [yes],
 # These flags should be enabled by default for all builds.
 AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [BASECFLAGS="$BASECFLAGS -fstack-protector-strong"], [AC_MSG_WARN([-fstack-protector-strong not supported])], [-Werror])
 AX_CHECK_COMPILE_FLAG([-Wtrampolines], [BASECFLAGS="$BASECFLAGS -Wtrampolines"], [AC_MSG_WARN([-Wtrampolines not supported])], [-Werror])
+AX_CHECK_COMPILE_FLAG([-D_FORTIFY_SOURCE=3], [BASECFLAGS="$BASECFLAGS -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"], [AC_MSG_WARN([-D_FORTIFY_SOURCE=3 not supported])])
 
 case $GCC in
 yes)

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Enable runtime protections for glibc to abort execution when unsafe behavior is encountered,`
	`2`	`+for all platforms except Windows.`