harden: -Werror=implicit-function-declaration (Makefile + build.sh)

CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to EigenScript are documented here.
 
 ## [Unreleased]
 
+### Hardening — `-Werror=implicit-function-declaration`
+
+- Added `-Werror=implicit-function-declaration` to the build flags (Makefile
+  `CFLAGS` and `build.sh`). An implicitly-declared function is assumed to
+  return `int`, so a pointer-returning function compiled without its prototype
+  has its return truncated to 32 bits on 64-bit — a corrupted pointer that
+  crashes at runtime, layout-dependently. That class just caused a remote DoS
+  in the HTTP server (the `strcasestr`/`_GNU_SOURCE` SEGV) and slipped through
+  CI as a mere warning. It's now a hard build error. The buildable surface is
+  warning-clean, so this is a no-op today except as a regression gate.
+
 ### Fixed — HTTP server crash (SEGV) on any request with a Content-Length header
 
 - **Security/robustness:** the server segfaulted on any request carrying a

Makefile

@@ -1,6 +1,12 @@
 VERSION := $(shell cat VERSION)
 CC      := gcc
-CFLAGS  := -Wall -Wextra -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE
+# -Werror=implicit-function-declaration: an implicitly-declared function is
+# assumed to return int, so on 64-bit a pointer-returning libc/GNU function
+# (e.g. strcasestr without _GNU_SOURCE) has its return truncated to 32 bits —
+# a corrupted pointer that segfaults at runtime, layout-dependently (this hid
+# a remote-DoS in ext_http through CI; see #239). Make the whole class a hard
+# build error instead of an ignorable warning.
+CFLAGS  := -Wall -Wextra -Werror=implicit-function-declaration -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE
 
 # RELRO/BIND_NOW are ELF concepts; macOS's ld64 rejects -z, and PIE is
 # already the default there. Without this split every Makefile link target

build.sh

@@ -22,7 +22,7 @@ JIT_FLAGS=""
 
 if [ "$1" = "full" ]; then
     # Full build: all extensions. Requires libpq-dev.
-    $CC -Wall -Wextra -O2 -fstack-protector-strong -o eigenscript $SOURCES ext_http.c ext_db.c \
+    $CC -Wall -Wextra -Werror=implicit-function-declaration -O2 -fstack-protector-strong -o eigenscript $SOURCES ext_http.c ext_db.c \
         model_io.c model_infer.c model_train.c \
         -I/usr/include/postgresql \
         -DEIGENSCRIPT_EXT_HTTP=1 \
@@ -34,7 +34,7 @@ if [ "$1" = "full" ]; then
     echo "EigenScript $VERSION (full) built. Binary: $(du -sh eigenscript | cut -f1)"
 else
     # Minimal build: language + stdlib only.
-    $CC -Wall -Wextra -O2 -fstack-protector-strong -o eigenscript $SOURCES \
+    $CC -Wall -Wextra -Werror=implicit-function-declaration -O2 -fstack-protector-strong -o eigenscript $SOURCES \
         -DEIGENSCRIPT_EXT_HTTP=0 \
         -DEIGENSCRIPT_EXT_MODEL=0 \
         -DEIGENSCRIPT_EXT_DB=0 \