[LLVMbugs] [Bug 5028] New: LLVM doesn't have -D_FORTIFY_SOURCE=x checks

[bugzilla-daemon at cs.uiuc.edu]

http://llvm.org/bugs/show_bug.cgi?id=5028

           Summary: LLVM doesn't have -D_FORTIFY_SOURCE=x checks
           Product: new-bugs
           Version: unspecified
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: new-feature
          Severity: normal
          Priority: P2
         Component: new bugs
        AssignedTo: unassignedbugs at nondot.org
        ReportedBy: iamleeg at gmail.com
                CC: llvmbugs at cs.uiuc.edu


Summary: the compile-time and run-time safety tests enabled by use of the
_FORTIFY_SOURCE macro are not included when compiling with LLVM-clang or
LLVM-GCC.

Steps to reproduce: take the following source code, and compile with the
version of llvm-gcc or clang from /Developer/usr/bin in an Xcode 3.2
installation on Snow Leopard.

#include <stdio.h>
#include <string.h>

int main (int argc, const char * argv[]) {
        char buffer[16];
        strcpy(buffer, "hello");
        strcpy(buffer, "This sentence is much too long for you.");
        strcpy(buffer, argv[1]);
        return 0;
}

Expected results: a warning is emitted by the compiler as it would be if
compiled with GCC, due to the statically-testable buffer overrun at the second
strcpy() invocation. If the compiled program is run, it should abort inside the
libc overrun-check function.

Actual results: no warning is emitted. The program crashes when the stack is
smashed.


-- 
Configure bugmail: http://llvm.org/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.