add -fstack-check and hardening

[libjh.git] / compile.sh

diff --git a/compile.sh b/compile.sh
index 042d710..9375a67 100755 (executable)
--- a/compile.sh
+++ b/compile.sh
@@ -11,7 +11,8 @@ set -f -u -e -o pipefail
 # flags for the build - adjust for your needs
 # delete all the generated stuff afterwards (with `rm -r gen`)
 CC='gcc'
 # flags for the build - adjust for your needs
 # delete all the generated stuff afterwards (with `rm -r gen`)
 CC='gcc'

-CFLAGS='-O3 -Wall -Werror -fPIC -std=c99 -march=native'
+# -fstack-check isn't just hardening - we do unbounded stack allocations in TPRINTF!
+CFLAGS='-O3 -Wall -Werror -Wno-error=strict-aliasing -fPIC -std=c99 -march=native -fstack-check -fstack-protector-all -D_FORTIFY_SOURCE=2'

 
 # create build environment if it doesn't exist yet
 mkdir -p gen # contains all generated files
 
 # create build environment if it doesn't exist yet
 mkdir -p gen # contains all generated files


@@ -24,6 +25,10 @@ echo "welcome. your friendly compiler will be \"$CC\" today." >&2
 echo "going ahead with CFLAGS=\"$CFLAGS\"..." >&2
 
 # generate header
 echo "going ahead with CFLAGS=\"$CFLAGS\"..." >&2
 
 # generate header

+set +f
+# needs correct order, so list them here
+cat header.h bufio.h > gen/jh.h
+set -f

 for source_file in $(ls|grep '\.c$'); do
   echo "extracting header data from $source_file..." >&2
   source_name="$(sed 's|\.c$||' <<< "$source_file")"
 for source_file in $(ls|grep '\.c$'); do
   echo "extracting header data from $source_file..." >&2
   source_name="$(sed 's|\.c$||' <<< "$source_file")"


@@ -33,12 +38,12 @@ for source_file in $(ls|grep '\.c$'); do
   sed 's|^PUBLIC_FN \(.*\){|KEEPLINE \1;|g' |
   sed 's|^PUBLIC_CONST |KEEPLINE #define |g' |
   sed 's|^HEADER |KEEPLINE |g' |
   sed 's|^PUBLIC_FN \(.*\){|KEEPLINE \1;|g' |
   sed 's|^PUBLIC_CONST |KEEPLINE #define |g' |
   sed 's|^HEADER |KEEPLINE |g' |

-  grep '^KEEPLINE' |
+  (set +e +o pipefail; grep '^KEEPLINE'; exit 0) |

   sed 's|^KEEPLINE ||g'
   
   echo ''
   echo ''
   sed 's|^KEEPLINE ||g'
   
   echo ''
   echo ''

-done > gen/jh.h
+done >> gen/jh.h

 
 # preprocess all source files
 for source_file in $(ls|grep '\.c$'); do
 
 # preprocess all source files
 for source_file in $(ls|grep '\.c$'); do


@@ -49,9 +54,10 @@ for source_file in $(ls|grep '\.c$'); do
   echo '#include "../jh.h"' > "gen/realc/$source_name.c"
   
   cat "$source_file" |
   echo '#include "../jh.h"' > "gen/realc/$source_name.c"
   
   cat "$source_file" |

-  grep -v '^PUBLIC_CONST ' |
+  (set +e +o pipefail; grep -v '^PUBLIC_CONST '; exit 0) |

   sed 's|^PUBLIC_FN ||g' |
   sed 's|^PUBLIC_FN ||g' |

-  grep -v '^HEADER ' |
+  (set +e +o pipefail; grep -v '^HEADER '; exit 0) |
+  sed 's| *JH_ATTR_[A-Z_]*||g' |

   cat >> "gen/realc/$source_name.c"
   if [ $? -ne 0 ]; then exit 1; fi
   
   cat >> "gen/realc/$source_name.c"
   if [ $? -ne 0 ]; then exit 1; fi
   


@@ -78,4 +84,5 @@ done
 # ... and link!
 cd gen/obj
 $CC -shared -Wl,-soname,libjh.so -o ../libjh.so $(ls)
 # ... and link!
 cd gen/obj
 $CC -shared -Wl,-soname,libjh.so -o ../libjh.so $(ls)

+ar rcs ../libjh.a $(ls)

 cd ../..
 cd ../..