debian/patches/stack-hardening.patch

   1 --- a/bin/mlton-script
   2 +++ b/bin/mlton-script
   3 @@ -87,6 +87,7 @@
   4          -target-cc-opt alpha                                     \
   5                  '-mieee -mbwx -mtune=ev6 -mfp-rounding-mode=d'   \
   6          -target-cc-opt amd64 '-m64'                              \
   7 +        -target-cc-opt linux '-fstack-protector-strong'          \
   8          -target-cc-opt aix '-maix64'                             \
   9          -target-cc-opt ia64-hpux "-mlp64"                        \
  10          -target-cc-opt ia64 "-mtune=itanium2"                    \
  11 @@ -104,7 +105,7 @@
  12                  '-mieee -mbwx -mtune=ev6 -mfp-rounding-mode=d'   \
  13          -target-link-opt aix '-maix64'                           \
  14          -target-link-opt ia64-hpux "-mlp64"                      \
  15 -        -target-link-opt linux '-Wl,-znoexecstack'               \
  16 +        -target-link-opt linux '-Wl,-znoexecstack,-zrelro'       \
  17          -target-link-opt mingw                                   \
  18                  '-lws2_32 -lkernel32 -lpsapi -lnetapi32 -lwinmm' \
  19          -target-link-opt mingw '-Wl,--enable-stdcall-fixup'      \
  20 --- a/runtime/Makefile
  21 +++ b/runtime/Makefile
  22 @@ -106,6 +106,11 @@
  23  DEBUGXCFLAGS := -DASSERT=1 -Wno-uninitialized -O0 -g
  24  PICXCFLAGS :=
  25
  26 +# Use stack hardening for the C method calls on linux
  27 +ifeq ($(TARGET_OS), linux)
  28 +XCFLAGS += -fstack-protector-strong
  29 +endif
  30 +
  31  # Win32&64 don't use PIC code, all other platforms do
  32  ifeq ($(findstring $(TARGET_OS), mingw cygwin),)
  33  PICXCFLAGS += -fPIC