[Pkg-privacy-commits] [pidgin-otr] 149/255: Add cc and ld hardening options for mingw builds

[Ximin Luo]

This is an automated email from the git hooks/post-receive script.

infinity0 pushed a commit to branch experimental
in repository pidgin-otr.

commit 322853853da7818f0b76e2526fe070a0c5faafa5
Author: Jacob Appelbaum <jacob at appelbaum.net>
Date:   Wed Aug 22 00:28:46 2012 -0700

    Add cc and ld hardening options for mingw builds
    
    Add CC_HARDENING_OPTIONS with the following options:
    
      -fstack-protector-all -fPIE -Wstack-protector -fwrapv
      --param ssp-buffer-size=1
    
    Add LD_HARDENING_OPTIONS with the following options:
    
      --dynamicbase --nxcompat -pie
    
    Add linking against libssp for stack-protector-all
---
 Makefile.mingw | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/Makefile.mingw b/Makefile.mingw
index cd2aaf6..864983a 100644
--- a/Makefile.mingw
+++ b/Makefile.mingw
@@ -59,15 +59,21 @@ TARGET = pidgin-otr.dll
 # The target zipfile
 ZIPFILE = pidgin-otr-$(PIDGIN_OTR_VERSION).zip
 
+CC_HARDENING_OPTIONS ?= -fstack-protector-all -fPIE -Wstack-protector -fwrapv --param ssp-buffer-size=1
+# In theory, we'd also like the following:
+# LD_HARDENING_OPTIONS ?= -dynamicbase --nxcompat -pie -z relro -z now
+LD_HARDENING_OPTIONS ?= --dynamicbase --nxcompat -pie
+
 CC = i586-mingw32msvc-gcc
-LDFLAGS = -Wl,--enable-auto-image-base
+LDFLAGS = -Wl,--enable-auto-image-base $(LD_HARDENING_OPTIONS)
 LDLIBS = $(LIBOTRLIBDIR)/libotr.a -L$(GTK_WIN32_BUNDLE)/lib \
 	 -L$(PIDGIN_WIN32_LIBS) -lgtk-win32-2.0 -lglib-2.0 \
 	 -lgdk_pixbuf-2.0 -lgobject-2.0 -lpidgin -llibpurple \
-	 -lgcrypt -lgpg-error -L$(LIBINTLLIBDIR) -lintl
+	 -lgcrypt -lgpg-error -L$(LIBINTLLIBDIR) -lintl -lssp
 
 CC ?= gcc
-override CFLAGS += -g -O2 -Wall $(PIDGIN_HEADERS) $(PURPLE_HEADERS) \
+override CFLAGS += -g -O2 -Wall $(CC_HARDENING_OPTIONS) \
+	$(PIDGIN_HEADERS) $(PURPLE_HEADERS) \
 	$(GTK_HDRS) -I$(LIBOTRINCDIR) $(FPIC) -DUSING_GTK -DPURPLE_PLUGINS \
 	-DPIDGIN_OTR_VERSION=\"$(PIDGIN_OTR_VERSION)\" \
 	-DPIDGIN_NAME=\"Pidgin\" -I$(LIBINTLINCDIR) -DENABLE_NLS \

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-privacy/packages/pidgin-otr.git