Skip to content

Commit 56750ed

Browse files
AviaAvAviaAv
committed
try removing third party specification, other issues addressed
1 parent 0acabd3 commit 56750ed

File tree

8 files changed

+61
-70
lines changed

8 files changed

+61
-70
lines changed

‎CMake/external_libcurl.cmake‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
if(CHECK_FOR_UPDATES)
22

3-
string(REPLACE "${ADDITIONAL_COMPILER_FLAGS}" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
4-
string(REPLACE "${ADDITIONAL_COMPILER_FLAGS}" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
3+
string(REPLACE "${SECURITY_COMPILER_FLAGS}" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") # remove flags
4+
string(REPLACE "${SECURITY_COMPILER_FLAGS}" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
55
include(ExternalProject)
66
message(STATUS "Building libcurl enabled")
77

@@ -63,6 +63,6 @@ if(CHECK_FOR_UPDATES)
6363
endif()
6464
endif()
6565

66-
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
67-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
66+
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SECURITY_COMPILER_FLAGS}")
67+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SECURITY_COMPILER_FLAGS}")
6868
endif() #CHECK_FOR_UPDATES

‎CMake/unix_config.cmake‎

Lines changed: 38 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -47,60 +47,49 @@ macro(os_set_flags)
4747
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread")
4848
endif()
4949

50-
###############
51-
# According to SDLE we need to add the following flags for additional security:
52-
# Debug & Release:
53-
# -Wformat: Checks for format string vulnerabilities.
54-
# -Wformat-security: Ensures format strings are not vulnerable to attacks.
55-
# -fPIC: Generates position-independent code (PIC) suitable for shared libraries.
56-
# -fPIE: Generates position-independent executable (PIE) code.
57-
# -pie: Links the output as a position-independent executable.
58-
# -D_FORTIFY_SOURCE=2: Adds extra checks for buffer overflows.
59-
# -mfunction-return=thunk: Mitigates return-oriented programming (ROP) attacks. (Added flag -fcf-protection=none to allow it)
60-
# -mindirect-branch=thunk: Mitigates indirect branch attacks.
61-
# -mindirect-branch-register: Uses registers for indirect branches to mitigate attacks.
62-
# -fstack-protector: Adds stack protection to detect buffer overflows.
50+
51+
if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
52+
# Due to security reasons we need to add the following flags for additional security:
53+
# Debug & Release:
54+
# -Wformat: Checks for format string vulnerabilities.
55+
# -Wformat-security: Ensures format strings are not vulnerable to attacks.
56+
# -fPIC: Generates position-independent code during the compilation phase.
57+
# -fPIE: Generates position-independent executables during the compilation phase.
58+
# -D_FORTIFY_SOURCE=2: Adds extra checks for buffer overflows.
59+
# -fstack-protector: Adds stack protection to detect buffer overflows.
6360

64-
# Release only
65-
# -Werror: Treats all warnings as errors.
66-
# -Werror=format-security: Treats format security warnings as errors.
67-
# -z noexecstack: Marks the stack as non-executable to prevent certain types of attacks.
68-
# -Wl,-z,relro,-z,now: Enables read-only relocations and immediate binding for security.
69-
# -fstack-protector-strong: Provides stronger stack protection than -fstack-protector.
70-
71-
# see https://readthedocs.intel.com/SecureCodingStandards/2023.Q2.0/compiler/c-cpp/ for more details
61+
# Release only
62+
# -Werror: Treats all warnings as errors.
63+
# -Werror=format-security: Treats format security warnings as errors.
64+
# -z noexecstack: Marks the stack as non-executable to prevent certain types of attacks.
65+
# -Wl,-z,relro,-z,now: Enables read-only relocations and immediate binding for security.
66+
# -fstack-protector-strong: Provides stronger stack protection than -fstack-protector.
67+
68+
# Linker flags
69+
# -pie: Produces position-independent executables during the linking phase.
70+
71+
# see https://readthedocs.intel.com/SecureCodingStandards/2023.Q2.0/compiler/c-cpp/ for more details
7272

73-
if (CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|armv7l" OR APPLE OR # Some flags are not recognized or some systems / gcc versions
74-
(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS "9.0")) #
75-
set(ADDITIONAL_COMPILER_FLAGS "-Wformat -Wformat-security -fPIC -fstack-protector")
76-
else()
77-
#‘-mfunction-return’ and ‘-fcf-protection’ are not compatible, so specifing -fcf-protection=none
78-
set(ADDITIONAL_COMPILER_FLAGS "-Wformat -Wformat-security -fPIC -fcf-protection=none -mfunction-return=thunk -mindirect-branch=thunk -mindirect-branch-register -fstack-protector")
79-
endif()
80-
set(CMAKE_LINKER_FLAGS "${CMAKE_LINKER_FLAGS} -pie")
81-
82-
set(ADDITIONAL_COMPILER_FLAGS "${ADDITIONAL_COMPILER_FLAGS} -Wno-error=stringop-overflow")
73+
set(SECURITY_COMPILER_FLAGS "-Wformat -Wformat-security -fPIC -fstack-protector -Wno-error=stringop-overflow")
8374

84-
string(FIND "${CMAKE_CXX_FLAGS}" "-D_FORTIFY_SOURCE" _index)
85-
if (${_index} EQUAL -1) # Define D_FORTIFY_SOURCE is undefined
86-
set(ADDITIONAL_COMPILER_FLAGS "${ADDITIONAL_COMPILER_FLAGS} -D_FORTIFY_SOURCE=2")
87-
endif()
75+
string(FIND "${CMAKE_CXX_FLAGS}" "-D_FORTIFY_SOURCE" _index)
76+
if (${_index} EQUAL -1) # Define D_FORTIFY_SOURCE if undefined
77+
set(SECURITY_COMPILER_FLAGS "${SECURITY_COMPILER_FLAGS} -D_FORTIFY_SOURCE=2")
78+
endif()
8879

89-
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
90-
message(STATUS "Configuring for Debug build")
91-
else() # Release, RelWithDebInfo, or multi configuration generator is being used (aka not specifing build type, or building with VS)
92-
message(STATUS "Configuring for Release build")
93-
set(ADDITIONAL_COMPILER_FLAGS "${ADDITIONAL_COMPILER_FLAGS} -Werror -z noexecstack -Wl,-z,relro,-z,now -fstack-protector-strong")
94-
endif()
95-
96-
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
97-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
98-
99-
100-
set_directory_properties(PROPERTIES DIRECTORY third-party/ COMPILE_OPTIONS "-w")
101-
set_source_files_properties(third-party/*.* PROPERTIES COMPILE_OPTIONS "-w")
80+
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
81+
message(STATUS "Configuring for Debug build")
82+
else() # Release, RelWithDebInfo, or multi configuration generator is being used (aka not specifing build type, or building with VS)
83+
message(STATUS "Configuring for Release build")
84+
set(SECURITY_COMPILER_FLAGS "${SECURITY_COMPILER_FLAGS} -Werror -z noexecstack -Wl,-z,relro,-z,now -fstack-protector-strong")
85+
endif()
86+
87+
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SECURITY_COMPILER_FLAGS}")
88+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SECURITY_COMPILER_FLAGS}")
89+
90+
set(CMAKE_LINKER_FLAGS "${CMAKE_LINKER_FLAGS} -pie")
10291

103-
#################
92+
endif()
10493

10594
if(APPLE)
10695
set(FORCE_RSUSB_BACKEND ON)

‎CMake/windows_config.cmake‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,35 +41,37 @@ macro(os_set_flags)
4141
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP")
4242

4343
###############
44-
# According to SDLE we need to add the following flags for additional security:
44+
# Due to security reasons we need to add the following flags for additional security:
4545
# Debug & Release:
4646
# /Gy: Enables function-level linking to reduce executable size.
4747
# /DYNAMICBASE: Enables Address Space Layout Randomization (ASLR) to improve security.
4848
# /GS: Enables buffer security checks to prevent buffer overflows.
4949

5050
# Release only:
5151
# /WX: Treats all warnings as errors.
52-
# /LTCG (/GL): Enables Link Time Code Generation to improve performance.
5352
# /sdl: Enables additional security checks.
53+
54+
# Release only linker flags:
55+
# /LTCG (/GL): Enables Link Time Code Generation to improve performance.
5456
# /NXCOMPAT: Enables Data Execution Prevention (DEP) to prevent code execution in data areas.
5557

5658
# see https://readthedocs.intel.com/SecureCodingStandards/2023.Q2.0/compiler/c-cpp/ for more details
5759

58-
set(ADDITIONAL_COMPILER_FLAGS "/Gy /DYNAMICBASE /GS /wd4101")
60+
set(SECURITY_COMPILER_FLAGS "/Gy /DYNAMICBASE /GS /wd4101")
5961

6062
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
6163
message(STATUS "Configuring for Debug build")
6264
else() # Release, RelWithDebInfo, or multi configuration generator is being used (aka not specifing build type, or building with VS)
6365
message(STATUS "Configuring for Release build")
64-
set(ADDITIONAL_COMPILER_FLAGS "${ADDITIONAL_COMPILER_FLAGS} /WX /sdl")
65-
set(CMAKE_LINKER_FLAGS "${CMAKE_LINKER_FLAGS} /INCREMENTAL:NO /LTCG /NXCOMPAT") # ignoring '/INCREMENTAL' due to '/LTCG' specification
66+
set(SECURITY_COMPILER_FLAGS "${SECURITY_COMPILER_FLAGS} /WX /sdl")
6667
endif()
6768

68-
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
69-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${ADDITIONAL_COMPILER_FLAGS}")
70-
71-
set_directory_properties(PROPERTIES DIRECTORY third-party/ COMPILE_OPTIONS "/W0")
72-
set_source_files_properties(third-party/*.* PROPERTIES COMPILE_OPTIONS "/W0")
69+
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SECURITY_COMPILER_FLAGS}")
70+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SECURITY_COMPILER_FLAGS}")
71+
72+
if(NOT CMAKE_BUILD_TYPE STREQUAL "Debug")
73+
set(CMAKE_LINKER_FLAGS "${CMAKE_LINKER_FLAGS} /INCREMENTAL:NO /LTCG /NXCOMPAT") # ignoring '/INCREMENTAL' due to '/LTCG' specification
74+
endif()
7375

7476
#################
7577

‎examples/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ set(CMAKE_EXPORT_COMPILE_COMMANDS 1)
77
# View the makefile commands during build
88
#set(CMAKE_VERBOSE_MAKEFILE on)
99

10-
string(REPLACE "-fPIC" "-fPIE" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") # examples are exeutables so we want position indepandent exeutables and not libraries
10+
string(REPLACE "-fPIC" "-fPIE" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") # examples are executables so we want position indepandent executables and not libraries
1111

1212
set( DEPENDENCIES ${LRS_TARGET} )
1313
if(BUILD_GRAPHICAL_EXAMPLES)

‎src/hid/hid-device.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@ namespace librealsense
334334
//we want to change the sensitivity values only in gyro, for FW version >= 5.16
335335
if( featureReport.reportId == REPORT_ID_GYROMETER_3D
336336
&& _realsense_hid_report_actual_size == sizeof( REALSENSE_HID_REPORT ) )
337-
featureReport.sensitivity = (unsigned short)sensitivity;
337+
featureReport.sensitivity = static_cast<unsigned short>(sensitivity);
338338

339339

340340
res = dev->control_transfer(USB_REQUEST_CODE_SET,

‎src/uvc/uvc-device.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ namespace librealsense
177177
switch(state)
178178
{
179179
case D0:
180-
_messenger = _usb_device->open((uint8_t)_info.mi);
180+
_messenger = _usb_device->open(static_cast<uint8_t>(_info.mi));
181181
if (_messenger)
182182
{
183183
try{
@@ -654,7 +654,7 @@ namespace librealsense
654654

655655
void rs_uvc_device::listen_to_interrupts()
656656
{
657-
auto ctrl_interface = _usb_device->get_interface((uint8_t)_info.mi);
657+
auto ctrl_interface = _usb_device->get_interface(static_cast<uint8_t>(_info.mi));
658658
if (!ctrl_interface)
659659
return;
660660
auto iep = ctrl_interface->first_endpoint(RS2_USB_ENDPOINT_DIRECTION_READ, RS2_USB_ENDPOINT_INTERRUPT);
@@ -856,7 +856,7 @@ namespace librealsense
856856
req,
857857
probe ? (UVC_VS_PROBE_CONTROL << 8) : (UVC_VS_COMMIT_CONTROL << 8),
858858
ctrl->bInterfaceNumber, // When requestType is directed to an interface, the driver automatically passes the interface number in the low byte of index
859-
buf, (uint32_t)len, transferred, 0);
859+
buf, static_cast<uint32_t>(len), transferred, 0);
860860
} while (sts != RS2_USB_STATUS_SUCCESS && retries++ < 5);
861861
}
862862
}, [this](){ return !_messenger; });

‎src/uvc/uvc-streamer.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ namespace librealsense
2828

2929
_action_dispatcher.start();
3030

31-
_watchdog_timeout = (int64_t)((1000.0 / _context.profile.fps) * 10);
31+
_watchdog_timeout = static_cast<int64_t>(((1000.0 / _context.profile.fps) * 10));
3232

3333
init();
3434
}

‎tools/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ set(CMAKE_EXPORT_COMPILE_COMMANDS 1)
77
# View the makefile commands during build
88
#set(CMAKE_VERBOSE_MAKEFILE on)
99

10-
string(REPLACE "-fPIC" "-fPIE" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") # tools are exeutables so we want position indepandent exeutables and not libraries
10+
string(REPLACE "-fPIC" "-fPIE" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}") # tools are executables so we want position indepandent executables and not libraries
1111

1212
list( APPEND DEPENDENCIES ${LRS_TARGET} tclap )
1313

0 commit comments

Comments
 (0)