From 86be268e49cf79244ec4519d3f46f135b599dee0 Mon Sep 17 00:00:00 2001
From: Jordan Wiens <github@psifertex.com>
Date: Sat, 8 Nov 2025 11:21:45 -0500
Subject: [PATCH] Fix: Add -Wa,--noexecstack to cc_builder for assembly files

---
 aws-lc-sys/builder/cc_builder.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/aws-lc-sys/builder/cc_builder.rs b/aws-lc-sys/builder/cc_builder.rs
index 5f10132e53a..71a6b29bd32 100644
--- a/aws-lc-sys/builder/cc_builder.rs
+++ b/aws-lc-sys/builder/cc_builder.rs
@@ -354,6 +354,14 @@ impl CcBuilder {
         if !cflags.is_empty() {
             set_env_for_target("CFLAGS", cflags);
         }
+
+        // Add --noexecstack flag for assembly files to prevent executable stacks
+        // This matches the behavior of AWS-LC's CMake build which uses -Wa,--noexecstack
+        // See: https://github.com/aws/aws-lc/blob/main/crypto/CMakeLists.txt#L77
+        if target_os() == "linux" || target_os().ends_with("bsd") {
+            cc_build.asm_flag("-Wa,--noexecstack");
+        }
+
         cc_build
     }