summaryrefslogtreecommitdiff
path: root/include (follow)
AgeCommit message (Collapse)Author
2023-08-21Harden umaskjvoisin
2023-08-21Make use of __diagnose_ifjvoisin
2023-08-21Remove some todo in __bmo's implementationjvoisin
2023-08-21Add tests for fgetws and mbsrtowcsjvoisin
2023-08-20Add more __access annotations in stdio.hjvoisin
2023-08-20Add two __format annotationsjvoisin
2023-08-20Make use of __diagnose_as_builtinjvoisin
2023-08-20Use pass_dynamic_object_size only for FORTIFY_SOURCE > 2jvoisin
2023-08-20Make use of pass_dynamic_object_size when availablejvoisin
2023-08-20Fix clang buildjvoisin
- s/CLFAGS/CFLAGS/ - provide paths to local includes - sprinkle more __pass_object_size__ - remove a problematic test
2023-08-20Add hardening for strrchrjvoisin
2023-08-20Add hardening for strchrjvoisin
2023-08-20Remove memrchr hardening for nowjvoisin
It doesn't play nice with gcc.
2023-08-03Add hardening for memchr and memrchrjvoisin
2023-07-18Make use of the alloc_size attributejvoisin
2023-07-10Clean up a bit the macro helljvoisin
2023-07-09Add some malloc annotationsjvoisin
2023-07-09Add some `format` annotationsjvoisin
2023-07-09Move a misplaced #endifjvoisin
2023-07-09Add an __access__ annotation to wchar.hjvoisin
2023-07-09Improve a bit `size_t*size_t` overflow checksjvoisin
2023-07-09Add access annotations to unistd.hjvoisin
2023-07-05Add access annotations to sys/socket.hjvoisin
2023-06-27Add more access-annotationsjvoisin
2023-06-25Fix clang supportjvoisin
2023-06-25add initial clang supportDaniel Kolesa
2023-06-25avoid __extension__ with clangDaniel Kolesa
It seems useless and triggers 'error: expected external declaration'
2023-06-22Add an annotation for fgetsjvoisin
2023-06-22Add a test for `poll`jvoisin
2023-06-22Add a test for strncatjvoisin
2023-06-22Add tests for stcncpyjvoisin
2023-06-22Add tests for stpcpyjvoisin
2023-06-14Add tests for strncpy and handle overlapping buffers therejvoisin
2023-05-30Add some __attribute__((access…)) annotationsjvoisin
See https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html for details
2023-05-30Add a check for overlapping copies in strcpyjvoisin
2023-05-30Fix inconsistent time_t version of ppolljvoisin
fortify/poll.h includes poll.h, which redirects the ppoll sys call to __ppoll_time64, if the _REDIR_TIME64 macro is 1. Then fortify/poll.h will #undef ppoll and use the 32 bit version, which is inconsistent. Taken from: https://github.com/openwrt/openwrt/pull/12575
2023-04-13Make use of __builtin_dynamic_object_sizejvoisin
GCC and Clang provide __builtin_dynamic_object_size (see documentation: https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html), so we should make use of it when its available.
2019-03-13getgroups: do not trap on non-positive gidsetsizeinfo@mobile-stream.com
First, we should never check the size of __s if __l == 0 since the array is not going to be modified in that case. Second, negative __l is a well-defined error case (EINVAL) and we should never trap on a conforming code like this: r = getgroups(-1, NULL); if (r == -1) ... An example of non-desired behaviour for negative __l is the gnulib configure script which checks for getgroups(-1, ...) to catch some ancient FreeBSD kernel bug. The conftest binary traps even on good system (e.g. linux/musl) and the unnecessary getgroups wrapper is enforced for any project that uses gnulib. This patch also changes the size_t cast to avoid the explicit zero extension on systems where size_t differs from unsigned int.
2019-03-07wctomb, wcrtomb: guard slow/trap path with MB_LEN_MAXinfo@mobile-stream.com
This allows the compiler to optimize out the slow/trap path at all for the typical correct code: char buf[MB_LEN_MAX]; r = wctomb(buf, c); The change tries to keep the "unknown object size" case handling in wcrtomb() as is even if it seems redundant and not helping (we copy __buf to possibly undersized __s in any case) and inconsistent with wctomb() (where we let the original library method itself overwrite the possibly undersized __s).
2019-03-07realpath: guard slow/trap path with PATH_MAXinfo@mobile-stream.com
This allows the compiler to optimize out the slow/trap path at all for the typical correct code: char buf[PATH_MAX]; r = realpath(path, buf); The change keeps the "unknown object size" case handling intact.
2019-02-25Make use of builtins whenever possiblesin
2018-07-24Don't use __extension__ in C++ codeA. Wilcox
A few important notes: * __extension__ is a GNU C "alternate" keyword, not a C++ keyword.[1] * __extension__ is designed to work on "expressions"; it does work on #include_next in C mode, but it has no effect in C++ mode; the warning will still appear, if enabled, even with __extension__ preceding #include_next. This is because #include_next is not considered an expression in C++, so the compiler attaches __extension__ to the first expression of the header. All of this leads us to a build failure while building at least all Mozilla software. Moz has an alternate -isystem dir searched before /usr/include that overrides some headers, including <features.h>. The first statement in each of these headers is a #pragma, and since __extension__ is looking for an expression, and #pragma is a "null" expression, we end up with the following error: dist/system_wrappers/features.h:1:9: error: '#pragma' is not allowed here Since __extension__ has no effect on #include_next in C++ mode anyway, and since it can cause breakage, this commit omits __extension__ in C++ mode. [1]: https://gcc.gnu.org/onlinedocs/gcc-6.4.0/gcc/Alternate-Keywords.html
2017-08-22Don't trap if an encoding error occurs in wcrtomb()sin
The POSIX definition of wcrtomb (http://pubs.opengroup.org/onlinepubs/9699919799/functions/wcrtomb.html) states: "When wc is not a valid wide character, an encoding error shall occur. In this case, the function shall store the value of the macro [EILSEQ] in errno and shall return (size_t)-1; the conversion state shall be undefined." The fortify-headers implementation of wcrtomb interprets the result -1 as 18446744073709551615 bytes. Since this is the highest 64-bit number possible, it is pretty safe to say this will always be larger than any buffer provided to wcrtomb. Therefore, it traps. Fixes bug https://bugs.alpinelinux.org/issues/7681. Patch by A. Wilcox <AWilcox@Wilcox-Tech.com>
2016-09-10Bump copyright yearsin
2016-07-14Only include limits.h when actually usedNatanael Copa
The __extension__ seems to trigger a bug in gcc when there are no identifier specified afterwards. Testcase: echo "#include <stdlib.h>" > try.c && cc -O0 -c try.c try.c:2:0: error: expected identifier or '(' at end of input With -O2 it does not happen. We work around this by only pulling in limits.h when we actually need the PATH_MAX. Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
2015-07-16Only crash on overflow for realpath()sin
2015-07-15Fix stpncpy() checksin
Do not crash unless the overflow would happen.
2015-07-15Fix confstr() checksin
Do not crash unless the overflow would actually happen.
2015-07-15Fix wcrtomb() checksin
This was breaking valid code, example: char c; wcrtomb(&c, L'0', st);
2015-06-25Add __extension__ mark to include_next to silence -pedanticSteven Barth
Signed-off-by: Steven Barth <steven@midlink.org>