Skip to content

[RFC] Modules:CheckSourceCompiles: verify syntax is valid before assert source compile

Bertrand Jacquin requested to merge beber/cmake:master into master

Note: this is a Request for Comment only, this PR is not ready for merge, however I'd be happy to get feedback on the feature and some help to build proper tests

One of the issue identified as part of CVE-2024-3094 1 3 4 investigations were seemingly improvement of test case 2 to enable landlock feature, however the change instead brought in silent failure in check_c_source_compiles(), preventing the feature from ever be enabled.

Whether a code compile or not should only refer to whether the platform has necessary condition in place to have the code compiling (compiler, libraries etc), but should not be silently fail if the syntax itself is invalid, allowing seemingly sane but with malicious intention to never meet success criteria.

This commit adds a new feature in CHECK_SOURCE_COMPILES() and derivatives to verify if C and C++ code has valid syntax using -fsyntax-only, before proceeding with regular a compile test. -fsyntax-only is supported by gcc 5 and >=clang-2.1 6 as language-independent options do not enable specific warnings but control the kinds of diagnostics produced.

Only C and C++ are supported in this commit as I don't have enough knowledge for other language/compiler, however should be able to be added using the same logic.

One downside of this change is doubling the number of compiler spawn for C and C++ source code, likely to increase execution time.

Edited by Bertrand Jacquin

Merge request reports