Skip to content

Commit 43ad0f8

Browse files
ismaildscho
authored andcommitted
Enable DEP and ASLR
Enable DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) support. This applies to both 32bit and 64bit builds and makes it substantially harder to exploit security holes in Git by offering a much more unpredictable attack surface. ASLR interferes with GDB's ability to set breakpoints. A similar issue holds true when compiling with -O2 (in which case single-stepping is messed up because GDB cannot map the code back to the original source code properly). Therefore we simply enable ASLR only when an optimization flag is present in the CFLAGS, using it as an indicator that the developer does not want to debug in GDB anyway. Signed-off-by: İsmail Dönmez <[email protected]> Signed-off-by: Johannes Schindelin <[email protected]>
1 parent 06fd645 commit 43ad0f8

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

config.mak.uname

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,6 +570,12 @@ else
570570
ifneq ($(shell expr "$(uname_R)" : '1\.'),2)
571571
# MSys2
572572
prefix = /usr/
573+
# Enable DEP
574+
BASIC_LDFLAGS += -Wl,--nxcompat
575+
# Enable ASLR (unless debugging)
576+
ifneq (,$(findstring -O,$(CFLAGS)))
577+
BASIC_LDFLAGS += -Wl,--dynamicbase
578+
endif
573579
ifeq (MINGW32,$(MSYSTEM))
574580
prefix = /mingw32
575581
HOST_CPU = i686

0 commit comments

Comments
 (0)