Detect compile type (preprocess, compile, link) correctly.

The arguments to gcc (-E, -S, -c) and the file extension are used to
detect the correct type.

This fixes many false positives and a few false negatives.

Thanks to Bernhard R. Link for the idea.

diff --git a/bin/blhc b/bin/blhc
index bf5f8ff58dc1edddd4208c703ee8c702d808266a..3d5f73c054229f45146713f3a9a871142f79b047 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -36,6 +36,81 @@ my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
 
+# Regex for source files which require preprocessing.
+my $source_preprocess_compile_regex = qr/
+    # C
+      c
+    # Objective-C
+    | m
+    # C++
+    | cc | cp | cxx | cpp | CPP | c\+\+ | C
+    # Objective-C++
+    | mm | M
+    # Fortran
+    | F | FOR | fpp | FPP | FTN | F90 | F95 | F03 | F08
+    /x;
+my $source_preprocess_no_compile_regex = qr/
+    # Assembly
+      s
+    /x;
+my $source_preprocess_regex = qr/
+      $source_preprocess_compile_regex
+    | $source_preprocess_no_compile_regex
+    /x;
+# Regex for source files which don't require preprocessing.
+my $source_no_preprocess_compile_regex = qr/
+    # C
+      i
+    # C++
+    | ii
+    # Objective-C
+    | mi
+    # Objective-C++
+    | mii
+    # Fortran
+    | f | for | ftn | f90 | f95 | f03 | f08
+    /x;
+my $source_no_preprocess_no_compile_regex = qr/
+    # Assembly
+      S | sx
+    /x;
+my $source_no_preprocess_regex = qr/
+      $source_no_preprocess_compile_regex
+    | $source_no_preprocess_no_compile_regex
+    /x;
+# Regex for header files which require preprocessing.
+my $header_preprocess_regex = qr/
+    # C, C++, Objective-C, Objective-C++
+      h
+    # C++
+    | hh | H | hp | hxx | hpp | HPP | h\+\+ | tcc
+    /x;
+# Regexps to match files with the given characteristics.
+my $file_no_preprocess_regex = qr/
+    $cc_regex.+?
+    \.(?: $source_no_preprocess_regex)\b
+    /x;
+my $file_preprocess_regex = qr/
+    $cc_regex.+?
+    \.(?: $header_preprocess_regex
+        | $source_preprocess_regex)\b
+    /x;
+my $file_compile_link_regex = qr/
+    $cc_regex.+?
+    \.(?: $source_preprocess_regex
+        | $source_no_preprocess_regex)\b
+    /x;
+my $file_compile_regex = qr/
+    $cc_regex.+?
+    \.(?: $source_preprocess_compile_regex
+        | $source_no_preprocess_compile_regex)\b
+    /x;
+my $file_no_compile_regex = qr/
+    $cc_regex.+
+    \.(?: $source_preprocess_no_compile_regex
+        | $source_no_preprocess_no_compile_regex)\b
+    /x;
+
 # Expected (hardening) flags. All flags are used as regexps.
 my @cflags = (
     '-g',
@@ -443,47 +518,60 @@ for (my $i = 0; $i < scalar @input; $i++) {
     # Even if it's a verbose build, we might have to skip this line.
     next if $skip;
 
+    # Skip unnecessary tests when only preprocessing.
+    my $flag_preprocess = 0;
+
+    my $preprocess = 0;
+    my $compile    = 0;
+    my $link       = 0;
 
-    # Is this a compiler or linker command?
-    my $compiler = 1;
-    my $linker   = 0;
-
-    # Linker commands.
-    if ($line =~ m{\s-o                        # -o
-                   [\s\\]*\s+                  # possible line continuation
-                   (?:[/.A-Za-z0-9~_-]+/)?     # path to file
-                        [A-Za-z0-9~_-]+        # binary name (no dots!)
-                   (?:[0-9.]*\.so[0-9.]*[a-z]? # library (including version)
-                    |\.la
-                    |\.cgi)?                   # CGI binary
-                   (?:\s|\\|$)                 # end of file name
-                  }x
-            or $line =~ /^libtool: link: /
-            or $line =~ m{\s*/bin/bash .+?libtool\s+(.+?\s+)?--mode=(re)?link}) {
-        $compiler = 0;
-        $linker   = 1;
+    # Preprocess, compile, assemble.
+    if ($line =~ /$cc_regex.*?\s(-E|-S|-c)\b/) {
+        $preprocess      = 1;
+        $flag_preprocess = 1 if $1 eq '-E';
+        $compile         = 1 if $1 eq '-S' or $1 eq '-c';
+    # Otherwise assume we are linking.
+    } else {
+        $link = 1;
+    }
+
+    # These file types don't require preprocessing.
+    if ($line =~ /$file_no_preprocess_regex/) {
+        $preprocess = 0;
+    }
+    # These file types require preprocessing.
+    if ($line =~ /$file_preprocess_regex/) {
+        $preprocess = 1;
     }
 
     # If there are source files then it's compiling/linking in one step and we
-    # must check both.
-    if ($line =~ /\.(?:c|cc|cpp)\b/) {
-        $compiler = 1;
+    # must check both. We only check for source files here, because header
+    # files cause too many false positives.
+    if (not $flag_preprocess and $line =~ /$file_compile_link_regex/) {
+        # Assembly files don't need CFLAGS.
+        if (not $line =~ /$file_compile_regex/
+                and $line =~ /$file_no_compile_regex/) {
+            $compile = 0;
+        # But the rest does.
+        } else {
+            $compile = 1;
+        }
     }
 
     # Check hardening flags.
     my @missing;
-    if ($compiler and not all_flags_used($line, \@missing, @cflags)
+    if ($compile and not all_flags_used($line, \@missing, @cflags)
             # Libraries linked with -fPIC don't have to (and can't) be linked
             # with -fPIE as well. It's no error if only PIE flags are missing.
             and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)) {
         error_flags('CFLAGS missing', \@missing, \%flag_renames, $line);
         $exit |= 1 << 3;
     }
-    if ($compiler and not all_flags_used($line, \@missing, @cppflags)) {
+    if ($preprocess and not all_flags_used($line, \@missing, @cppflags)) {
         error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $line);
         $exit |= 1 << 3;
     }
-    if ($linker and not all_flags_used($line, \@missing, @ldflags)
+    if ($link and not all_flags_used($line, \@missing, @ldflags)
             # Same here, -fPIC conflicts with -fPIE.
             and not pic_pie_conflict($line, $harden_pie, \@missing, @ldflags_pie)) {
         error_flags('LDFLAGS missing', \@missing, \%flag_renames, $line);

diff --git a/t/logs/bad b/t/logs/bad
index 49357a1e96b3d69b51e5bd8a64194ee7ac46423e..32408855cd9ce93cb4518fa903a4367a5621dc39 100644 (file)
--- a/t/logs/bad
+++ b/t/logs/bad
@@ -23,3 +23,10 @@ g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-securi
 gcc -o test test-a.o test-b.o test-c.a
 
 g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+
+gcc -c -o test test.S
+gcc -c -o test test.s
+
+gcc -E test.c
+
+gcc test.c

diff --git a/t/logs/bad-cflags b/t/logs/bad-cflags
index 3de1841595aee5657eb85c88fe393f76eacabac1..e231307a8915ffe353f01747c2b9a88c4b49339b 100644 (file)
--- a/t/logs/bad-cflags
+++ b/t/logs/bad-cflags
@@ -8,3 +8,7 @@ gcc -Wl,-z,relro -o test test-a.o test-b.o test-c.o -ltest
 # Compiling and linking in one step must also check CFLAGS/CPPFLAGS.
 gcc -Wl,-z,relro -o test test.c -ltest
 gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
+
+gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+
+gcc test.c -o test.output

diff --git a/t/logs/bad-cppflags b/t/logs/bad-cppflags
index 48e7f5a807699fbdf779706177e95dba7eb97945..a4d83b1195815c92fc1ad8e1085364d9d6c005ae 100644 (file)
--- a/t/logs/bad-cppflags
+++ b/t/logs/bad-cppflags
@@ -4,3 +4,7 @@ gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-securit
 gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c test-b.c
 gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c test-c.c
 gcc -Wl,-z,relro -o test test-a.o test-b.o test-c.o -ltest
+
+gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c ../../../../src/test/test.c -o test.so.o
+
+g++ -o test -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test-a.cxx test-b.o test-c.o -Wl,-z,relro

diff --git a/t/logs/bad-library b/t/logs/bad-library
index 383a8dbb729955a10480fc4d8ce306436fdbe2fe..ec7603e7e30a39e2eec658c4f259fca8c153fb2d 100644 (file)
--- a/t/logs/bad-library
+++ b/t/logs/bad-library
@@ -1,6 +1,6 @@
 dpkg-buildpackage: source package test
 
-gcc -D_FORTIFY_SOURCE=2 -g -O2 --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.o
+gcc -D_FORTIFY_SOURCE=2 -g -O2 --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.so
 gcc -shared -fPIC -DPIC libtest.o -lpthread -O2 -Wl,relro -Wl,--as-needed -o libtest.so
 gcc -shared -fPIC -DPIC libtest.o -lpthread -O2 -Wl,--as-needed -o libtest.so
 
@@ -10,3 +10,5 @@ gcc -shared -o libtest.so.0d ./test-a.o test/./test-b.o -Wl,-z,now -lpthread -ld
 /usr/bin/g++ -shared -fpic -o libtest-6.1.so.0 test.o -ltiff -lz
 
 gcc -Wl,--as-needed  -fPIE -pie -o test.cgi test.o -lgcrypt
+
+gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -o lib`basename test/test`.so

diff --git a/t/logs/cc b/t/logs/cc
index 38e7cab845c534cd0ac7053f1ec2c3f9d961a670..49df5c7e289ae674c5e46734b6076ddd4a2cb2af 100644 (file)
--- a/t/logs/cc
+++ b/t/logs/cc
@@ -6,4 +6,8 @@ cc -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -
 cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
 cc -Wl,-z,defs -o test test-a.o test-b.o test-c.o -ltest
 
+rm cc-test.h
+cc\
+    test.cc
+
 cc -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o

diff --git a/t/logs/g++ b/t/logs/g++
index 7118ef130d2542a0062bf2f27e21a20245195d97..3c372a1dc6fe681c26e698f708f80582697dfbc9 100644 (file)
--- a/t/logs/g++
+++ b/t/logs/g++
@@ -21,6 +21,10 @@ x86_64-linux-gnu-g++ -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -lt
 
 g++ -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 
+rm g++test.h
+g++\
+    test.c
+
 g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
 g++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
 g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp

diff --git a/t/logs/gcc b/t/logs/gcc
index e90dba5190fe90f42d402b314f3e3f2c5b22b1c2..def411d5ef7ef354c8913ca1036e26e3a4b8e3a0 100644 (file)
--- a/t/logs/gcc
+++ b/t/logs/gcc
@@ -8,4 +8,8 @@ gcc-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-secur
 gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
 gcc-4.6 -Wl,-z,defs -o test test-a.o test-b.o test-c.o -ltest
 
+rm gcc-test.h
+gcc\
+    test.c
+
 gcc-4.6 -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o

diff --git a/t/logs/good b/t/logs/good
index 447ff17fb30e47ca9e4a45cb70e524ceccfe35c3..82a6d97f548472a1f8a56c41712b632d2c0a2af3 100644 (file)
--- a/t/logs/good
+++ b/t/logs/good
@@ -20,3 +20,12 @@ g++ -D_FORTIFY_SOURCE=2  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wfo
 g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
 
 g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro ../src/test/objs/test.o -o ../src/test/bin/test
+
+gcc -c -o test test.S
+gcc -D_FORTIFY_SOURCE=2 -c -o test test.s
+
+gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+
+gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro test.c -o test.output
+
+gcc -E -D_FORTIFY_SOURCE=2 test.c

diff --git a/t/logs/good-library b/t/logs/good-library
index a104f0d96934ccd8b85a39c5f8704206fd065792..a52c84f3a3c3a0ac6bcbe6a3007c795b0da662e5 100644 (file)
--- a/t/logs/good-library
+++ b/t/logs/good-library
@@ -2,7 +2,7 @@ dpkg-buildpackage: source package test
 
 # -fPIC and -fPIE conflict with each other and -fPIE is not necessary for
 # libraries.
-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.o
+gcc -D_FORTIFY_SOURCE=2 -g -Wl,relro -Wl,now -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.so
 gcc -shared -fPIC -DPIC libtest.o -lpthread -O2 -Wl,relro -Wl,now -Wl,--as-needed -o libtest.so
 
 gcc -shared -fPIC test.o -Wl,-z -Wl,relro -Wl,now -o .libs/libtest.so.1.0.0
@@ -11,3 +11,11 @@ gcc -shared -fPIE -pie -o libtest.so.0d ./test-a.o test/./test-b.o -Wl,-z,relro
 /usr/bin/g++ -shared -fpic -Wl,-z,relro -Wl,-z,now -o libtest-6.1.so.0 test.o -ltiff -lz
 
 gcc -Wl,-z,now -Wl,-z,relro -Wl,--as-needed  -fPIE -pie -o test.cgi test.o -lgcrypt
+
+gcc -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -fPIE -pie -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -o lib`basename test/test`.so
+
+gcc -fPIE -pie -Wl,-z,relro -Wl,-z,now -o test+test test+test.o
+gcc -fPIE -pie -Wl,-z,relro -Wl,-z,now -o test.test test.test.o
+gcc -fPIE -pie -Wl,-z,relro -Wl,-z,now -o test.bin test.test.o
+gcc -fPIE -pie -Wl,-z,relro -Wl,-z,now -o test.real test.test.o
+gcc -fPIE -pie -Wl,-z,relro -Wl,-z,now -o test.cgi test.test.o

diff --git a/t/tests.t b/t/tests.t
index 09c22f158aa57a005251a3bb32a4d6e9f4ec08a0..d754c64f858d323d6fdf0acf3421ca74b53270a5 100644 (file)
--- a/t/tests.t
+++ b/t/tests.t
@@ -107,6 +107,11 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++  -g -O2 -fstack-protector --param=ss
 LDFLAGS missing (-Wl,-z,relro): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-Wl,-z,relro): gcc -o test test-a.o test-b.o test-c.a
 LDFLAGS missing (-Wl,-z,relro): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -c -o test test.s
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -E test.c
+CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c
+LDFLAGS missing (-Wl,-z,relro): gcc test.c
 ';
 is_blhc 'bad', '--pie', 8,
         'CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -g -O2 -c test-a.c
@@ -129,6 +134,11 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro): g++  -g -O2 -fstack-protector --param
 LDFLAGS missing (-fPIE -pie): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro): gcc -o test test-a.o test-b.o test-c.a
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -c -o test test.s
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -E test.c
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro): gcc test.c
 ';
 is_blhc 'bad', '--bindnow', 8,
         'CFLAGS missing (-fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -g -O2 -c test-a.c
@@ -150,6 +160,11 @@ LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param
 LDFLAGS missing (-Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
 LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc -o test test-a.o test-b.o test-c.a
 LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -c -o test test.s
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -E test.c
+CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c
+LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc test.c
 ';
 is_blhc 'bad', '--pie --bindnow', 8,
         'CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -g -O2 -c test-a.c
@@ -172,6 +187,11 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protec
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc -o test test-a.o test-b.o test-c.a
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -c -o test test.s
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -E test.c
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc test.c
 ';
 is_blhc 'bad', '--all', 8,
         'CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -g -O2 -c test-a.c
@@ -194,6 +214,11 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protec
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc -o test test-a.o test-b.o test-c.a
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ../src/test/objs/test.o -o ../src/test/bin/test
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -c -o test test.s
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -E test.c
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc test.c
 ';
 
 is_blhc 'bad-cflags', '', 8,
@@ -204,6 +229,10 @@ CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wfo
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -Wl,-z,relro -o test test.c -ltest
 CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
+CFLAGS missing (-Wformat): gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c -o test.output
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c -o test.output
+LDFLAGS missing (-Wl,-z,relro): gcc test.c -o test.output
 ';
 is_blhc 'bad-cflags', '--pie', 8,
         'CFLAGS missing (-fPIE -Wformat): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c
@@ -215,6 +244,10 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -Wl,-z,relro -o test test.c -ltest
 LDFLAGS missing (-fPIE -pie): gcc -Wl,-z,relro -o test test.c -ltest
 CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
+CFLAGS missing (-Wformat): gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c -o test.output
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c -o test.output
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro): gcc test.c -o test.output
 ';
 is_blhc 'bad-cflags', '--bindnow', 8,
         'CFLAGS missing (-Wformat): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c
@@ -227,6 +260,10 @@ LDFLAGS missing (-Wl,-z,now): gcc -Wl,-z,relro -o test test.c -ltest
 CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 LDFLAGS missing (-Wl,-z,now): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
+CFLAGS missing (-Wformat): gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c -o test.output
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c -o test.output
+LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc test.c -o test.output
 ';
 is_blhc 'bad-cflags', '--pie --bindnow', 8,
         'CFLAGS missing (-fPIE -Wformat): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c
@@ -239,12 +276,18 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,now): gcc -Wl,-z,relro -o test test.c -ltest
 CFLAGS missing (-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
 LDFLAGS missing (-Wl,-z,now): gcc -shared -fPIC -Wl,-z,relro -o test.so test.c -ltest
+CFLAGS missing (-Wformat): gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c -D_FORTIFY_SOURCE=2 ../../../../src/test/test.c -o test.so.o
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc test.c -o test.output
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc test.c -o test.output
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc test.c -o test.output
 ';
 
 is_blhc 'bad-cppflags', '', 8,
         'CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c test-a.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c test-b.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c test-c.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -c ../../../../src/test/test.c -o test.so.o
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++ -o test -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test-a.cxx test-b.o test-c.o -Wl,-z,relro
 ';
 
 is_blhc 'bad-ldflags', '', 8,
@@ -291,13 +334,17 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2):  \ gcc -g -O2 -fstack-protector --param=
 ';
 
 is_blhc 'bad-library', '--all', 8,
-        'CFLAGS missing (-fstack-protector): gcc -D_FORTIFY_SOURCE=2 -g -O2 --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.o
+        'CFLAGS missing (-fstack-protector): gcc -D_FORTIFY_SOURCE=2 -g -O2 --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.so
+LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc -D_FORTIFY_SOURCE=2 -g -O2 --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -fPIC -DPIC -o libtest.so
 LDFLAGS missing (-Wl,-z,now): gcc -shared -fPIC -DPIC libtest.o -lpthread -O2 -Wl,relro -Wl,--as-needed -o libtest.so
 LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc -shared -fPIC -DPIC libtest.o -lpthread -O2 -Wl,--as-needed -o libtest.so
 LDFLAGS missing (-Wl,-z,now): gcc -shared -fPIC test.o -Wl,-z -Wl,relro -o .libs/libtest.so.1.0.0
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro): gcc -shared -o libtest.so.0d ./test-a.o test/./test-b.o -Wl,-z,now -lpthread -ldl
 LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): /usr/bin/g++ -shared -fpic -o libtest-6.1.so.0 test.o -ltiff -lz
 LDFLAGS missing (-Wl,-z,relro -Wl,-z,now): gcc -Wl,--as-needed  -fPIE -pie -o test.cgi test.o -lgcrypt
+CFLAGS missing (-fPIE): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -o lib`basename test/test`.so
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -o lib`basename test/test`.so
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security test.c -o lib`basename test/test`.so
 ';
 
 
@@ -363,6 +410,9 @@ CFLAGS missing (-fPIE -Wformat): cc -g -O2 -fstack-protector --param=ssp-buffer-
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): cc -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c
 CFLAGS missing (-fPIE -Werror=format-security): cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): cc -Wl,-z,defs -o test test-a.o test-b.o test-c.o -ltest
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): cc\     test.cc
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): cc\     test.cc
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): cc\     test.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): cc -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 ';
 
@@ -375,6 +425,9 @@ CFLAGS missing (-fPIE -Wformat): gcc-4.6 -g -O2 -fstack-protector --param=ssp-bu
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): gcc-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c
 CFLAGS missing (-fPIE -Werror=format-security): gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc-4.6 -Wl,-z,defs -o test test-a.o test-b.o test-c.o -ltest
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): gcc\     test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc\     test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc\     test.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): gcc-4.6 -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 ';
 
@@ -390,6 +443,7 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++ -Wl,-z,defs -o test te
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): c++ -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): c++\     test.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): c++\     test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++\     test.c
 CFLAGS missing (-fPIE -Wformat): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): c++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
 CFLAGS missing (-fPIE -Werror=format-security): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
@@ -412,6 +466,9 @@ CFLAGS missing (-fPIE -Werror=format-security): x86_64-linux-gnu-g++ -g -O2 -fst
 CFLAGS missing (-fPIE): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): x86_64-linux-gnu-g++ -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++ -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): g++\     test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++\     test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++\     test.c
 CFLAGS missing (-fPIE -Wformat): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): g++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
 CFLAGS missing (-fPIE -Werror=format-security): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp