Attachment 298147 Details for Bug 437627 – Check for incorrect FORTIFY_SOURCE use

Check for incorrect FORTIFY_SOURCE use

check-fortify.sh (text/plain), 2.27 KB, created by Lubomir Kundrak on 2008-03-15 13:46:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2008-03-15 13:46:08 UTC

Size: 2.27 KB

patch

obsolete

>#!/bin/bash
>
># Copyright (C) 2008 Lubomir Kundrak <lkundrak@redhat.com>
># $Id: check-fortify.sh,v 1.1 2008/03/15 13:32:35 lkundrak Exp $
>#  
># This program is free software; you can redistribute it and/or modify
># it under the terms of the GNU General Public License as published by
># the Free Software Foundation; version 1, 2 or 3 of the License.
>#  
># This program is distributed in the hope that it will be useful,
># but WITHOUT ANY WARRANTY; without even the implied warranty of
># MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
># GNU General Public License for more details.
>#  
># You should have received a copy of the GNU General Public License
># along with this program; if not, write to the Free Software
># Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
>
># Search files for unsafe symbols to detect FORTIFY_SOURCE misuse
>
># Tries to look at:
># 1.) RPM_BUILD_ROOT, or
># 2.) Arguments, or
># 3.) CWD
>
># Functions that FORTIFY_SOURCE should have replaced in all cases
>F8=$(echo {,s,f}printf)
>F9=$(echo {v,}{,s,f}printf)
>
># Not usable for F7 actually, C++ code was not being fortified there
>[ $(rpm --eval %fedora) -gt 7 ] && DF="$DF $F8"
>[ $(rpm --eval %fedora) -gt 8 ] && DF="$DF $F9"
>
>DM=$(echo $DF |sed 's/^/(/;s/ /|/g;s/$/)/')
>
># Hopefully more wacky filenames won't exist
>IFS="
>"
>[ -z "$RPM_BUILD_ROOT" ] && RPM_BUILD_ROOT=$*
>[ -z "$RPM_BUILD_ROOT" ] && RPM_BUILD_ROOT=.
>FILES=$(find $RPM_BUILD_ROOT -type f -perm /111)
>
>RETVAL=0
>
>for F in $FILES
>do
>	if OUT=$(
>		(eu-readelf -s "$F" 2>/dev/null) |
>		egrep "FUNC +GLOBAL +DEFAULT +UNDEF +$DM@GLIBC")
>	then
>		RETVAL=1
>		echo
>		echo "WARNING: File $F uses these possibly unsafe symbols:"
>		echo "$OUT"
>	fi
>done
>
>if [ $RETVAL != 0 ]
>then
>	echo
>	echo "***************************************************************************"
>	echo
>	echo "The above warnings might indicate that FORTIFY_SOURCE is not used correctly"
>	echo
>	echo "Possible causes:"
>	echo " 1.) %optflags are not passed to the compiler"
>	echo " 2.) Source files don't include the relevant headers"
>	echo
>	echo "***************************************************************************"
>	echo
>fi
>
># XXX: Do not cause the builds to fail yet,
># as it would cause severe breakage
>[ "$TOLERANT" != "0" ] && RETVAL=0
>
>[ ! -z "$TOLERANT" ] && RETVAL=0
>exit $RETVAL

Actions: View

Attachments on bug 437627: 298147