add -fstack-check and hardening

[libjh.git] / compile.sh

diff --git a/compile.sh b/compile.sh
index 5a4327b..9375a67 100755 (executable)
--- a/compile.sh
+++ b/compile.sh
@@ -11,7 +11,8 @@ set -f -u -e -o pipefail
 # flags for the build - adjust for your needs
 # delete all the generated stuff afterwards (with `rm -r gen`)
 CC='gcc'
 # flags for the build - adjust for your needs
 # delete all the generated stuff afterwards (with `rm -r gen`)
 CC='gcc'

-CFLAGS='-O3 -Wall -Werror -Wno-error=strict-aliasing -fPIC -std=c99 -march=native'
+# -fstack-check isn't just hardening - we do unbounded stack allocations in TPRINTF!
+CFLAGS='-O3 -Wall -Werror -Wno-error=strict-aliasing -fPIC -std=c99 -march=native -fstack-check -fstack-protector-all -D_FORTIFY_SOURCE=2'

 
 # create build environment if it doesn't exist yet
 mkdir -p gen # contains all generated files
 
 # create build environment if it doesn't exist yet
 mkdir -p gen # contains all generated files


@@ -83,4 +84,5 @@ done
 # ... and link!
 cd gen/obj
 $CC -shared -Wl,-soname,libjh.so -o ../libjh.so $(ls)
 # ... and link!
 cd gen/obj
 $CC -shared -Wl,-soname,libjh.so -o ../libjh.so $(ls)

+ar rcs ../libjh.a $(ls)

 cd ../..
 cd ../..