X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=76b6bed10b17abb8a9a4305db3aff63d97a60e49;hb=39548fd7ad454f3e3efc742605863ae0e84d5778;hp=b5dfa6822e55fec0858cd7ed4006dbbf6549143e;hpb=2a259b08620582db1693281cded2deb29708e16b;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index b5dfa68..76b6bed 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -102,6 +102,17 @@ my @header_preprocess = (
     # C++
     qw( hh H hp hxx hpp HPP h++ tcc ),
 );
+# Object files.
+my @object = (
+    # Normal object files.
+    qw ( o ),
+    # Libtool object files.
+    qw ( lo la ),
+    # Dynamic libraries. bzip2 uses .sho.
+    qw ( so sho ),
+    # Static libraries.
+    qw ( a ),
+);
 
 # Hashes for fast extensions lookup to check if a file falls in one of these
 # categories.
@@ -128,10 +139,14 @@ my %extensions_compile_cpp = map { $_ => 1 } (
     @source_preprocess_compile_cpp,
     @source_no_preprocess_compile_cpp,
 );
+my %extensions_object = map { $_ => 1 } (
+    @object,
+);
 my %extension = map { $_ => 1 } (
     @source_no_preprocess,
     @header_preprocess,
     @source_preprocess,
+    @object,
 );
 
 # Regexp to match file extensions.
@@ -601,6 +616,8 @@ FILE:
 foreach my $file (@ARGV) {
     print "checking '$file'...\n" if scalar @ARGV > 1;
 
+    -f $file or die "No such file: $file";
+
     open my $fh, '<', $file or die $!;
 
     # Architecture of this file.
@@ -961,18 +978,29 @@ LINE:
             $preprocess = 1;
         }
 
-        # If there are source files then it's compiling/linking in one step
-        # and we must check both. We only check for source files here, because
-        # header files cause too many false positives.
-        if (not $flag_preprocess
-                and extension_found(\%extensions_compile_link, @extensions)) {
-            # Assembly files don't need CFLAGS.
-            if (not extension_found(\%extensions_compile, @extensions)
-                    and extension_found(\%extensions_no_compile, @extensions)) {
-                $compile = 0;
-            # But the rest does.
-            } else {
-                $compile = 1;
+        if (not $flag_preprocess) {
+            # If there are source files then it's compiling/linking in one
+            # step and we must check both. We only check for source files
+            # here, because header files cause too many false positives.
+            if (extension_found(\%extensions_compile_link, @extensions)) {
+                # Assembly files don't need CFLAGS.
+                if (not extension_found(\%extensions_compile, @extensions)
+                        and extension_found(\%extensions_no_compile, @extensions)) {
+                    $compile = 0;
+                # But the rest does.
+                } else {
+                    $compile = 1;
+                }
+            # No compilable extensions found, either linking or compiling
+            # header flags.
+            #
+            # If there are also no object files we are just compiling headers
+            # (.h -> .h.gch). Don't check for linker flags in this case. Due
+            # to our liberal checks for compiler lines, this also reduces the
+            # number of false positives considerably.
+            } elsif ($link
+                    and not extension_found(\%extensions_object, @extensions)) {
+                $link = 0;
             }
         }
 
@@ -1109,6 +1137,9 @@ It's designed to check build logs generated by Debian's dpkg-buildpackage (or
 tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
 to help maintainers detect missing hardening flags in their packages.
 
+Only gcc is detected as compiler at the moment. If other compilers support
+hardening flags as well, please report them.
+
 If there's no output, no flags are missing and the build log is fine.
 
 =head1 OPTIONS