mingw: enable DEP and ASLR

Enable DEP (Data Execution Prevention) and ASLR (Address Space Layout
Randomization) support. This applies to both 32bit and 64bit builds
and makes it substantially harder to exploit security holes in Git by
offering a much more unpredictable attack surface.

ASLR interferes with GDB's ability to set breakpoints. A similar issue
holds true when compiling with -O2 (in which case single-stepping is
messed up because GDB cannot map the code back to the original source
code properly). Therefore we simply enable ASLR only when an
optimization flag is present in the CFLAGS, using it as an indicator
that the developer does not want to debug in GDB anyway.

Signed-off-by: İsmail Dönmez <ismail@i10z.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/config.mak.uname b/config.mak.uname
index 01b390c04310e1ff05ed63691d4be63fbdb515b5..6f92f4746ecf328eb52019aba067f3d8835f4314 100644 (file)
--- a/config.mak.uname
+++ b/config.mak.uname
@@ -575,6 +575,12 @@ else
        ifneq ($(shell expr "$(uname_R)" : '1\.'),2)
                # MSys2
                prefix = /usr/
+               # Enable DEP
+               BASIC_LDFLAGS += -Wl,--nxcompat
+               # Enable ASLR (unless debugging)
+               ifneq (,$(findstring -O,$(filter-out -O0 -Og,$(CFLAGS))))
+                       BASIC_LDFLAGS += -Wl,--dynamicbase
+               endif
                ifeq (MINGW32,$(MSYSTEM))
                        prefix = /mingw32
                        HOST_CPU = i686