From b58b224e429701a59f38c4eff6c9f5b2006c79dd Mon Sep 17 00:00:00 2001 From: Brad King Date: Tue, 21 Jan 2025 14:11:38 -0500 Subject: ci: Enable libc++ hardening in CMake build jobs on macOS This may help catch out-of-bounds container access and similar bugs. --- .gitlab/ci/configure_macos_arm64_ninja.cmake | 3 +++ .gitlab/ci/configure_macos_x86_64_ninja.cmake | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.gitlab/ci/configure_macos_arm64_ninja.cmake b/.gitlab/ci/configure_macos_arm64_ninja.cmake index 78193bf..eb319c9 100644 --- a/.gitlab/ci/configure_macos_arm64_ninja.cmake +++ b/.gitlab/ci/configure_macos_arm64_ninja.cmake @@ -15,5 +15,8 @@ set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") +# https://libcxx.llvm.org/Hardening.html +set(CMAKE_CXX_FLAGS "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") diff --git a/.gitlab/ci/configure_macos_x86_64_ninja.cmake b/.gitlab/ci/configure_macos_x86_64_ninja.cmake index c6131a2..9de043e 100644 --- a/.gitlab/ci/configure_macos_x86_64_ninja.cmake +++ b/.gitlab/ci/configure_macos_x86_64_ninja.cmake @@ -18,5 +18,8 @@ set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") +# https://libcxx.llvm.org/Hardening.html +set(CMAKE_CXX_FLAGS "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") -- cgit v0.12