- # Check hardening flags.
- my @missing;
- if ($compile and not all_flags_used($line, \@missing, @cflags)
- # Libraries linked with -fPIC don't have to (and can't) be linked
- # with -fPIE as well. It's no error if only PIE flags are missing.
- and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
- # Assume dpkg-buildflags returns the correct flags.
- and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
- error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
- } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
- # Libraries linked with -fPIC don't have to (and can't) be linked
- # with -fPIE as well. It's no error if only PIE flags are missing.
- and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
- # Assume dpkg-buildflags returns the correct flags.
- and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
- error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
- }
- if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
- # Assume dpkg-buildflags returns the correct flags.
- and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
- error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
- }
- if ($link and not all_flags_used($line, \@missing, @ldflags)
- # Same here, -fPIC conflicts with -fPIE.
- and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
- # Assume dpkg-buildflags returns the correct flags.
- and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
- error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
- $exit |= 1 << 3;
+ # These file types don't require preprocessing.
+ if (extension_found(\%extensions_no_preprocess, @extensions)) {
+ $preprocess = 0;
+ }
+ # These file types require preprocessing.
+ if (extension_found(\%extensions_preprocess, @extensions)) {
+ $preprocess = 1;
+ }
+
+ # If there are source files then it's compiling/linking in one step and we
+ # must check both. We only check for source files here, because header
+ # files cause too many false positives.
+ if (not $flag_preprocess
+ and extension_found(\%extensions_compile_link, @extensions)) {
+ # Assembly files don't need CFLAGS.
+ if (not extension_found(\%extensions_compile, @extensions)
+ and extension_found(\%extensions_no_compile, @extensions)) {
+ $compile = 0;
+ # But the rest does.
+ } else {
+ $compile = 1;
+ }
+ }
+
+ # Assume CXXFLAGS are required when a C++ file is specified in the
+ # compiler line.
+ my $compile_cpp = 0;
+ if ($compile
+ and extension_found(\%extensions_compile_cpp, @extensions)) {
+ $compile = 0;
+ $compile_cpp = 1;
+ }
+
+ # Check hardening flags.
+ my @missing;
+ if ($compile and not all_flags_used($line, \@missing, @cflags)
+ # Libraries linked with -fPIC don't have to (and can't) be linked
+ # with -fPIE as well. It's no error if only PIE flags are missing.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
+ error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
+ # Libraries linked with -fPIC don't have to (and can't) be linked
+ # with -fPIE as well. It's no error if only PIE flags are missing.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
+ error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }
+ if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
+ error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }
+ if ($link and not all_flags_used($line, \@missing, @ldflags)
+ # Same here, -fPIC conflicts with -fPIE.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
+ error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+ $exit |= 1 << 3;
+ }