From e02be629bbdd80c84ebf5c21f0b4d2d24504980a Mon Sep 17 00:00:00 2001 From: Michael Schuster Date: Fri, 31 Jul 2020 23:51:28 +0200 Subject: [PATCH] Windows: Enable CFG and SafeSEH linker security flags See: https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard https://docs.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers Signed-off-by: Michael Schuster --- src/CMakeLists.txt | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index c74c66535..a79edfcfb 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -34,9 +34,15 @@ if(NOT MSVC) endif() if(WIN32) - # Enable DEP & ASLR - set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /nxcompat /dynamicbase") - set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} /nxcompat /dynamicbase") + # Enable DEP, ASLR and CFG + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /nxcompat /dynamicbase /guard:cf") + set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} /nxcompat /dynamicbase /guard:cf") + + # x86 only: Enable SafeSEH + if(CMAKE_SYSTEM_PROCESSOR MATCHES "i686.*|i386.*|x86.*") + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} /safeseh") + set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} /safeseh") + endif() elseif(UNIX AND NOT APPLE) set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro -Wl,-z,now") set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-z,relro -Wl,-z,now") -- 2.30.2