michaelh/zephyr
1
0
Fork 0
Code Releases Activity

cmake: Allow selection of libc API overflow detection mode

Browse source 
This adds a choice of three different libc API buffer overflow detection
modes:

 * None
 * Compile-time
 * Compile-time and Run-time

These correspond with the clang/gcc _FORTIFY_SOURCE modes (0/1/2).
_FORTIFY_SOURCE depends on compiler optimizations and require libc support
which the minimal C library doesn't include, so _FORTIFY_SOURCE is disabled
by default in those cases. Native tooling might also enable
_FORTIFY_SOURCE, so don't enable it by default in that case either.

Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Keith Packard 2022-04-26 19:24:11 -07:00 • committed by Stephanos Ioannidis
commit 62bc9bf3e5
6 changed files with 52 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
CMakeLists.txt
View file

@ -157,8 +157,18 @@ zephyr_compile_options($<$<COMPILE_LANGUAGE:C>:$<TARGET_PROPERTY:compiler,no_str
zephyr_compile_options($<$<COMPILE_LANGUAGE:CXX>:$<TARGET_PROPERTY:compiler-cpp,no_strict_aliasing>>)
# @Intent: Set compiler flags to enable buffer overflow checks in libc functions
# @config in CONFIG_NO_OPTIMIZATIONS optional : Optimizations may affect security
zephyr_compile_definitions($<TARGET_PROPERTY:compiler,security_fortify> )
# @details:
# Kconfig.zephyr "Detect buffer overflows in libc calls" is a kconfig choice,
# ensuring at most *one* of CONFIG_FORTIFY_SOURCE_{COMPILE_TIME,RUN_TIME} is
# set. Refer to Kconfig.zephyr for selection logic and description of these
# choices. Toolchains set both of the security_fortify_{compile_time,run_time}
# properties and the Kconfig settings are used here to select between those.
#
if(CONFIG_FORTIFY_SOURCE_RUN_TIME)
zephyr_compile_definitions($<TARGET_PROPERTY:compiler,security_fortify_run_time> )
elseif(CONFIG_FORTIFY_SOURCE_COMPILE_TIME)
zephyr_compile_definitions($<TARGET_PROPERTY:compiler,security_fortify_compile_time> )
endif()
# @Intent: Set compiler flags to detect general stack overflows across all functions
if(CONFIG_STACK_CANARIES)