+ if ($harden_fortify) {
+ @cflags = (@cflags, @def_cflags_fortify);
+ @cxxflags = (@cxxflags, @def_cflags_fortify);
+ @cppflags = (@cppflags, @def_cppflags_fortify);
+ }
+ if ($harden_format) {
+ @cflags = (@cflags, @def_cflags_format);
+ @cxxflags = (@cxxflags, @def_cflags_format);
+ }
+ if ($harden_relro) {
+ @ldflags = (@ldflags, @def_ldflags_relro);
+ }
+ if ($harden_bindnow) {
+ @ldflags = (@ldflags, @def_ldflags_bindnow);
+ }
+
+ for (my $i = 0; $i < scalar @input; $i++) {
+ my $line = $input[$i];
+
+ my $skip = 0;
+ if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
+ error_non_verbose_build($line);
+ $exit |= 1 << 2;
+ next;
+ }
+ # Even if it's a verbose build, we might have to skip this line.
+ next if $skip;
+
+ # Remove everything until and including the compiler command. Makes
+ # checks easier and faster.
+ $line =~ s/^.*?$cc_regex//o;
+
+ # Skip unnecessary tests when only preprocessing.
+ my $flag_preprocess = 0;
+
+ my $preprocess = 0;
+ my $compile = 0;
+ my $link = 0;
+
+ # Preprocess, compile, assemble.
+ if ($line =~ /\s(-E|-S|-c)\b/) {
+ $preprocess = 1;
+ $flag_preprocess = 1 if $1 eq '-E';
+ $compile = 1 if $1 eq '-S' or $1 eq '-c';
+ # Otherwise assume we are linking.
+ } else {
+ $link = 1;
+ }
+
+ # Get all file extensions on this line.
+ my @extensions = $line =~ /$file_extension_regex/go;
+ # Ignore all unknown extensions to speedup the search below.
+ @extensions = grep { exists $extension{$_} } @extensions;
+
+ # These file types don't require preprocessing.
+ if (extension_found(\%extensions_no_preprocess, @extensions)) {
+ $preprocess = 0;
+ }
+ # These file types require preprocessing.
+ if (extension_found(\%extensions_preprocess, @extensions)) {
+ $preprocess = 1;
+ }
+
+ # If there are source files then it's compiling/linking in one step
+ # and we must check both. We only check for source files here, because
+ # header files cause too many false positives.
+ if (not $flag_preprocess
+ and extension_found(\%extensions_compile_link, @extensions)) {
+ # Assembly files don't need CFLAGS.
+ if (not extension_found(\%extensions_compile, @extensions)
+ and extension_found(\%extensions_no_compile, @extensions)) {
+ $compile = 0;
+ # But the rest does.
+ } else {
+ $compile = 1;
+ }
+ }
+
+ # Assume CXXFLAGS are required when a C++ file is specified in the
+ # compiler line.
+ my $compile_cpp = 0;
+ if ($compile
+ and extension_found(\%extensions_compile_cpp, @extensions)) {
+ $compile = 0;
+ $compile_cpp = 1;
+ }
+
+ # Check hardening flags.
+ my @missing;
+ if ($compile and not all_flags_used($line, \@missing, @cflags)
+ # Libraries linked with -fPIC don't have to (and can't) be
+ # linked with -fPIE as well. It's no error if only PIE flags
+ # are missing.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
+ error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
+ # Libraries linked with -fPIC don't have to (and can't) be
+ # linked with -fPIE as well. It's no error if only PIE flags
+ # are missing.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
+ error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }
+ if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
+ error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }
+ if ($link and not all_flags_used($line, \@missing, @ldflags)
+ # Same here, -fPIC conflicts with -fPIE.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
+ error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }