Skip to content

Add clang hardening flags that we added for gcc #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
derobins merged 7 commits into from
Nov 24, 2025
Merged

Add clang hardening flags that we added for gcc #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
10b3656
Add clang hardening flags that we added for gcc
derobins Nov 23, 2025
96f9b10
Fix missing ${} when setting compiler version
derobins Nov 23, 2025
8093158
Only use _FORTIFY_SOURCE w/ -O2 or higher
derobins Nov 23, 2025
1f8e523
Fix CMake lint issues
derobins Nov 23, 2025
0434e1f
Remove duplicate _FORTIFY_SOURCE
derobins Nov 23, 2025
dba6efe
Add -Wbidi-chars=any to gcc flags
derobins Nov 23, 2025
abae76f
Consolidate gcc 12 blocks
derobins Nov 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions cmake/AISClangCompilerOptions.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,13 @@ function(get_ais_clang_warning_flags outvar compiler_version)
-Wno-c++14-compat-pedantic
-Wno-pre-c++17-compat-pedantic

# Turn on stack protection options
-fstack-clash-protection
-fstack-protector-strong

# Turn on strict flex arrays (helps ASAN, _FORTIFY_SOURCE, etc.)
-fstrict-flex-arrays=3

# Misc warnings
#
# This includes most warnings that are not enabled by default
Expand All @@ -74,6 +81,7 @@ function(get_ais_clang_warning_flags outvar compiler_version)
-Wcomma
-Wconditional-uninitialized
-Wconsumed
-Wconversion
#-Wcovered-switch-default (flags default labels where we handle all enum values)
-Wcstring-format-directive
-Wctad-maybe-unsupported
Expand All @@ -95,6 +103,7 @@ function(get_ais_clang_warning_flags outvar compiler_version)
-Wformat=2
-Wformat-non-iso
-Wformat-pedantic
-Wformat-security
-Wformat-type-confusion
-Wfour-char-constants
-Wfuse-ld-path
Expand Down Expand Up @@ -217,6 +226,15 @@ function(get_ais_clang_warning_flags outvar compiler_version)
)
endif()

# Only use _FORTIFY_SOURCE if the optimization level is -O2, -O3, or -Os
string(JOIN " " MYCXXFLAGS ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE}})
if(MYCXXFLAGS MATCHES "-O[2-3s]")
set(flags
-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3
${flags}
)
endif()

set(${outvar} ${flags} PARENT_SCOPE)

endfunction()
4 changes: 2 additions & 2 deletions cmake/AISCompilerOptions.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,9 @@ function(ais_set_compiler_flags target)
# there's mismatch between IWYU's clang and the compiler you are using.
if(NOT AIS_USE_IWYU)
if(compiler_id STREQUAL "GNU" OR compiler_id STREQUAL "NVIDIA")
get_ais_gnu_warning_flags(compiler_flags compiler_version)
get_ais_gnu_warning_flags(compiler_flags ${compiler_version})
elseif(compiler_id STREQUAL "Clang")
get_ais_clang_warning_flags(compiler_flags compiler_version)
get_ais_clang_warning_flags(compiler_flags ${compiler_version})
Copy link
Copy Markdown
Collaborator Author

@derobins derobins Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops. This has probably been broken for a while...

endif()
endif()
target_compile_options(${target} PRIVATE $<$<COMPILE_LANG_AND_ID:${language},${compiler_id}>:${compiler_flags}>)
Expand Down
12 changes: 10 additions & 2 deletions cmake/AISGNUCompilerOptions.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,13 +83,21 @@ function(get_ais_gnu_warning_flags outvar compiler_version)

if(compiler_version VERSION_GREATER_EQUAL 12)
set(flags
# Fortify source
-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3
# Misc warnings
-Wbidi-chars=any
-Winterference-size
-Wtrivial-auto-var-init
${flags}
)

# Only use _FORTIFY_SOURCE if the optimization level is -O2, -O3, or -Os
string(JOIN " " MYCXXFLAGS ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE}})
if(MYCXXFLAGS MATCHES "-O[2-3s]")
set(flags
-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3
${flags}
)
endif()
endif()

if(compiler_version VERSION_GREATER_EQUAL 13)
Expand Down
Loading