From e2a4d2f79c8b63e39dd65cca8e337b1e636b3aec Mon Sep 17 00:00:00 2001
From: Nate Ohlson <nohlson@purdue.edu>
Date: Mon, 8 Jul 2024 12:35:35 -0500
Subject: [PATCH 1/3] Add fortify source level 3 to default compiler options

---
 configure    | 39 +++++++++++++++++++++++++++++++++++++++
 configure.ac |  1 +
 2 files changed, 40 insertions(+)

diff --git a/configure b/configure
index 19786f18e61726..78529a6327ea77 100755
--- a/configure
+++ b/configure
@@ -9760,6 +9760,45 @@ else $as_nop
 printf "%s\n" "$as_me: WARNING: -Wtrampolines not supported" >&2;}
 fi
 
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -D_FORTIFY_SOURCE=3" >&5
+printf %s "checking whether C compiler accepts -D_FORTIFY_SOURCE=3... " >&6; }
+if test ${ax_cv_check_cflags___D_FORTIFY_SOURCE_3+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS  -D_FORTIFY_SOURCE=3"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main (void)
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ax_cv_check_cflags___D_FORTIFY_SOURCE_3=yes
+else $as_nop
+  ax_cv_check_cflags___D_FORTIFY_SOURCE_3=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___D_FORTIFY_SOURCE_3" >&5
+printf "%s\n" "$ax_cv_check_cflags___D_FORTIFY_SOURCE_3" >&6; }
+if test "x$ax_cv_check_cflags___D_FORTIFY_SOURCE_3" = xyes
+then :
+  BASECFLAGS="$BASECFLAGS -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
+else $as_nop
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: -D_FORTIFY_SOURCE=3 not supported" >&5
+printf "%s\n" "$as_me: WARNING: -D_FORTIFY_SOURCE=3 not supported" >&2;}
+fi
+
 
 case $GCC in
 yes)
diff --git a/configure.ac b/configure.ac
index df146cc9cf0b75..6e52e1c063884b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2516,6 +2516,7 @@ AS_VAR_IF([with_strict_overflow], [yes],
 # These flags should be enabled by default for all builds.
 AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [BASECFLAGS="$BASECFLAGS -fstack-protector-strong"], [AC_MSG_WARN([-fstack-protector-strong not supported])], [-Werror])
 AX_CHECK_COMPILE_FLAG([-Wtrampolines], [BASECFLAGS="$BASECFLAGS -Wtrampolines"], [AC_MSG_WARN([-Wtrampolines not supported])], [-Werror])
+AX_CHECK_COMPILE_FLAG([-D_FORTIFY_SOURCE=3], [BASECFLAGS="$BASECFLAGS -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"], [AC_MSG_WARN([-D_FORTIFY_SOURCE=3 not supported])])
 
 case $GCC in
 yes)

From 0a1eba9bf1d56dc697e641246a6377698fcdc44a Mon Sep 17 00:00:00 2001
From: "blurb-it[bot]" <43283697+blurb-it[bot]@users.noreply.github.com>
Date: Mon, 8 Jul 2024 23:39:06 +0000
Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?=
 =?UTF-8?q?rb=5Fit.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst

diff --git a/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst b/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
new file mode 100644
index 00000000000000..d02b7c7c718478
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
@@ -0,0 +1 @@
+Enable -D_FORTIFY_SOURCE=3 option for all builds to enhance security

From 7a595e7898018879040f52474e7e0273d914a3ef Mon Sep 17 00:00:00 2001
From: Nate Ohlson <nateohlson@gmail.com>
Date: Tue, 9 Jul 2024 10:40:15 -0500
Subject: [PATCH 3/3] Update news to better reflect impact of the compiler
 option

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
---
 .../Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst b/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
index d02b7c7c718478..d9b48993a2fb1a 100644
--- a/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
+++ b/Misc/NEWS.d/next/Security/2024-07-08-23-39-04.gh-issue-112301.TD8G01.rst
@@ -1 +1,2 @@
-Enable -D_FORTIFY_SOURCE=3 option for all builds to enhance security
+Enable runtime protections for glibc to abort execution when unsafe behavior is encountered,
+for all platforms except Windows.