X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=9800eafad367ab187ffedd6fe94ae9f4fc20ea45;hb=e8d66101e7bf4ba755df5c5f893402f98131fedf;hp=f99460249a9d47e728cbd28368989c364a65ed1e;hpb=33cf53c9dffe333db74d89b90e8b1d1bb88d91b9;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index f994602..9800eaf 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -142,13 +142,13 @@ my %extension = map { $_ => 1 } (
 # Regexp to match file extensions.
 my $file_extension_regex = qr/
     \s
-    \S+         # Filename without extension.
+    \S+             # Filename without extension.
     \.
-    ([^\\.\s]+) # File extension.
-    (?=\s|\\)   # At end of word. Can't use \b because some files have non
-                # word characters at the end and because \b matches double
-                # extensions (like .cpp.o). Works always as all lines are
-                # terminated with "\n".
+    ([^\\.,;:\s]+)  # File extension.
+    (?=\s|\\)       # At end of word. Can't use \b because some files have non
+                    # word characters at the end and because \b matches double
+                    # extensions (like .cpp.o). Works always as all lines are
+                    # terminated with "\n".
     /x;
 
 # Expected (hardening) flags. All flags are used as regexps.
@@ -193,6 +193,7 @@ my @def_ldflags_pie = (
 my @def_ldflags_pic = (
     '-fPIC',
     '-fpic',
+    '-shared',
 );
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
@@ -311,13 +312,16 @@ sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
-                or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+                or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
         return 0;
     }
 
+    # False positives.
+    return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+
     my $file = $1;
 
     # On the first pass we only check if this line is verbose or not.
@@ -571,23 +575,24 @@ FILE: foreach my $file (@ARGV) {
                 }
 
                 # Ignore lines with no compiler commands.
-                next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
+                next if not $non_verbose
+                        and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+                # Ignore lines with no filenames with extensions. May miss
+                # some non-verbose builds (e.g. "gcc -o test" [sic!]), but
+                # shouldn't be a problem as the log will most likely contain
+                # other non-verbose commands which are detected.
+                next if not $non_verbose
+                        and not $line =~ /$file_extension_regex/o;
 
                 # Ignore false positives.
                 #
                 # `./configure` output.
                 next if not $non_verbose
                         and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
-                next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
+                next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
                                    (?:C|c)ompiler[\s.]*:?\s+
-                                   $cc_regex_full
-                                   (?:\s-std=[a-z0-9:+]+)?\s*$
-                                 /xo
-                        or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o
-                        or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
-                        or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
-                # `make` output.
-                next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
+                                 /xo;
+                next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
 
                 # Check if additional hardening options were used. Used to
                 # ensure they are used for the complete build.
@@ -602,7 +607,11 @@ FILE: foreach my $file (@ARGV) {
     close $fh;
 
     if (scalar @input == 0) {
-        print "No compiler commands!\n";
+        if (not $option_buildd) {
+            print "No compiler commands!\n";
+        } else {
+            print "W-no-compiler-commands\n";
+        }
         $exit |= 1;
         next FILE;
     }
@@ -850,7 +859,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags
 
 =head1 SYNOPSIS
 
-B<blhc> [options] <dpkg-buildpackage build log file>..
+B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>
 
 =head1 DESCRIPTION
 
@@ -866,7 +875,7 @@ other important warnings. It's licensed under the GPL 3 or later.
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 
-=item B<--arch>
+=item B<--arch> I<architecture>
 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected