Re:Getting the maximum of your C compiler, for security
by nicolast on Tuesday August 31, 2021 @10:28AM
(#28368545)
There's also 'AX_APPEND_COMPILE_FLAGS' [1] (and its dependency 'AX_CHECK_COMPILE_FLAG' [2]), next to many other (related or unrelated) macros in the autoconf archive.
[1] https://www.gnu.org/software/autoconf-archive/ax_append_comp...
[2] https://www.gnu.org/software/autoconf-archive/ax_check_compi...
Re:Getting the maximum of your C compiler, for security
by rwmj on Tuesday August 31, 2021 @12:27PM
(#28370035)
I've filed loads of bugs against GCC -fanalyzer and most have been fixed so it's getting better. Most recent fix happened yesterday: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99260
However I do find the output to be very verbose.
Re:Getting the maximum of your C compiler, for security
by wyldfire on Tuesday August 31, 2021 @11:54AM
(#28369587)
clang has a static analyzer feature that IMO gives pretty good results. There's also a mode that's handy for long functions/funcs w/heavily nested blocks where it can show you the execution path necessary to hit a case (like used-uninitialized, e.g.).
I recall getting a bit excited when I first read about it, but the results I got where a bit bizarre (e.g. every single function that allocated memory and returned a pointer to it was labeled as leaking memory; not really any useful info).
I did the fun exercise myself once to riffle through the gcc manpage, cobble together warning flags and massage them into autoconf[1][2].
There is a very handy m4 script in the util-linux source for testing supported warning flags[3].
[1] https://git.infradead.org/mtd-utils.git/blob/HEAD:/configure...
[2] https://github.com/AgentD/squashfs-tools-ng/blob/master/conf...
[3] https://github.com/karelzak/util-linux/blob/master/m4/compil...