{"metadata": {"vulnerability": "CVE-2023-4039", "count": 188, "kinds": {"milestone": 33, "sighting": 5, "kev": 0, "other": 150}}, "data": [{"timestamp": "2023-08-01T10:38:03.032Z", "date_only": false, "value": "2023-08-01T10:38:03.032Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2023-4039", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-09-01T00:00:00Z", "date_only": false, "value": "2023-09-01T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-12T09:00:00Z", "date_only": false, "value": "2023-09-12T09:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arm", "record": "CVE-2023-4039", "field": "containers.cna.datePublic"}, {"timestamp": "2023-09-12T15:00:00Z", "date_only": false, "value": "2023-09-12T15:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2023-4039", "record": "UBUNTU-CVE-2023-4039", "field": "published"}, {"timestamp": "2023-09-13T08:05:10.274Z", "date_only": false, "value": "2023-09-13T08:05:10.274Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2023-4039", "field": "cveMetadata.datePublished"}, {"timestamp": "2023-09-13T09:15:15.690Z", "date_only": false, "value": "2023-09-13T09:15:15.690", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-4039", "record": "FKIE_CVE-2023-4039", "field": "published"}, {"timestamp": "2023-09-13T09:15:15.690Z", "date_only": false, "value": "2023-09-13T09:15:15.690", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2023-4039", "record": "GSD-2023-4039", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2023-09-13T12:34:52Z", "date_only": false, "value": "2023-09-13T12:34:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/70370", "record": "CVE-2023-4039", "field": "creation_timestamp", "uuid": "335a592e-50db-40ec-9392-66a0045649a7", "content": "\u203c CVE-2023-4039 \u203c\n\nA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/70370"}, {"timestamp": "2023-09-13T22:00:00Z", "date_only": false, "value": "2023-09-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-13T22:00:00Z", "date_only": false, "value": "2023-09-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-13T22:00:00Z", "date_only": false, "value": "2023-09-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-09-15T00:00:00Z", "date_only": false, "value": "2023-09-15T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-15T00:00:00Z", "date_only": false, "value": "2023-09-15T00:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2023-09-18T11:58:42Z", "date_only": false, "value": "2023-09-18T11:58:42Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-18T11:58:42Z", "date_only": false, "value": "2023-09-18T11:58:42Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-09-18T11:58:42Z", "date_only": false, "value": "2023-09-18T11:58:42Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-09-18T11:58:42Z", "date_only": false, "value": "2023-09-18T11:58:42Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-18T19:45:23Z", "date_only": false, "value": "2023-09-18T19:45:23Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3661-1", "record": "SUSE-SU-2023:3661-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-18T19:45:23Z", "date_only": false, "value": "2023-09-18T19:45:23Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:3661-1", "record": "SUSE-SU-2023:3661-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-09-18T19:45:23Z", "date_only": false, "value": "2023-09-18T19:45:23Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3661-1", "record": "SUSE-SU-2023:3661-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-09-18T19:45:23Z", "date_only": false, "value": "2023-09-18T19:45:23Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:3661-1", "record": "SUSE-SU-2023:3661-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-18T19:45:23Z", "date_only": false, "value": "2023-09-18T19:45:23Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3661-1", "record": "SUSE-SU-2023:3661-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-09-18T19:48:26Z", "date_only": false, "value": "2023-09-18T19:48:26Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3662-1", "record": "SUSE-SU-2023:3662-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-18T19:48:26Z", "date_only": false, "value": "2023-09-18T19:48:26Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:3662-1", "record": "SUSE-SU-2023:3662-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-09-18T19:48:26Z", "date_only": false, "value": "2023-09-18T19:48:26Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3662-1", "record": "SUSE-SU-2023:3662-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-09-18T19:48:26Z", "date_only": false, "value": "2023-09-18T19:48:26Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:3662-1", "record": "SUSE-SU-2023:3662-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-18T19:48:26Z", "date_only": false, "value": "2023-09-18T19:48:26Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3662-1", "record": "SUSE-SU-2023:3662-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-09-18T22:00:00Z", "date_only": false, "value": "2023-09-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2023-09-19T15:24:52Z", "date_only": false, "value": "2023-09-19T15:24:52Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3686-1", "record": "SUSE-SU-2023:3686-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-09-19T15:24:52Z", "date_only": false, "value": "2023-09-19T15:24:52Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:3686-1", "record": "SUSE-SU-2023:3686-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-09-19T15:24:52Z", "date_only": false, "value": "2023-09-19T15:24:52Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3686-1", "record": "SUSE-SU-2023:3686-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-09-19T15:24:52Z", "date_only": false, "value": "2023-09-19T15:24:52Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:3686-1", "record": "SUSE-SU-2023:3686-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-09-19T15:24:52Z", "date_only": false, "value": "2023-09-19T15:24:52Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3686-1", "record": "SUSE-SU-2023:3686-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-09-19T22:00:00Z", "date_only": false, "value": "2023-09-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2023-10-13T11:06:11Z", "date_only": false, "value": "2023-10-13T11:06:11Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2023-1735", "record": "OESA-2023-1735", "field": "published"}, {"timestamp": "2023-10-17T22:00:00Z", "date_only": false, "value": "2023-10-17T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2679", "record": "WID-SEC-W-2023-2679", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-10-17T22:00:00Z", "date_only": false, "value": "2023-10-17T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2679", "record": "WID-SEC-W-2023-2679", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-10-17T22:00:00Z", "date_only": false, "value": "2023-10-17T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2679", "record": "WID-SEC-W-2023-2679", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-10-17T22:00:00Z", "date_only": false, "value": "2023-10-17T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2679", "record": "WID-SEC-W-2023-2679", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-10-23T13:33:48Z", "date_only": false, "value": "2023-10-23T13:33:48Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:4162-1", "record": "SUSE-SU-2023:4162-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-10-23T13:33:48Z", "date_only": false, "value": "2023-10-23T13:33:48Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:4162-1", "record": "SUSE-SU-2023:4162-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-10-23T13:33:48Z", "date_only": false, "value": "2023-10-23T13:33:48Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4162-1", "record": "SUSE-SU-2023:4162-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-10-23T13:33:48Z", "date_only": false, "value": "2023-10-23T13:33:48Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:4162-1", "record": "SUSE-SU-2023:4162-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-10-23T13:33:48Z", "date_only": false, "value": "2023-10-23T13:33:48Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4162-1", "record": "SUSE-SU-2023:4162-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-10-23T22:00:00Z", "date_only": false, "value": "2023-10-23T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2023-10-31T23:00:00Z", "date_only": false, "value": "2023-10-31T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2023-11-02T23:00:00Z", "date_only": false, "value": "2023-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2023-11-16T13:39:44Z", "date_only": false, "value": "2023-11-16T13:39:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:4458-1", "record": "SUSE-SU-2023:4458-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-11-16T13:39:44Z", "date_only": false, "value": "2023-11-16T13:39:44Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:4458-1", "record": "SUSE-SU-2023:4458-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-11-16T13:39:44Z", "date_only": false, "value": "2023-11-16T13:39:44Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4458-1", "record": "SUSE-SU-2023:4458-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-11-16T13:39:44Z", "date_only": false, "value": "2023-11-16T13:39:44Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:4458-1", "record": "SUSE-SU-2023:4458-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-11-16T13:39:44Z", "date_only": false, "value": "2023-11-16T13:39:44Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4458-1", "record": "SUSE-SU-2023:4458-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-11-16T23:00:00Z", "date_only": false, "value": "2023-11-16T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2023-11-20T09:15:44Z", "date_only": false, "value": "2023-11-20T09:15:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-11-20T09:15:44Z", "date_only": false, "value": "2023-11-20T09:15:44Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2023-11-20T09:15:44Z", "date_only": false, "value": "2023-11-20T09:15:44Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.generator.date"}, {"timestamp": "2023-11-20T09:15:44Z", "date_only": false, "value": "2023-11-20T09:15:44Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-11-20T23:00:00Z", "date_only": false, "value": "2023-11-20T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2023-12-12T00:00:00Z", "date_only": false, "value": "2023-12-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-12-12T00:00:00Z", "date_only": false, "value": "2023-12-12T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-12-12T00:00:00Z", "date_only": false, "value": "2023-12-12T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-12-12T00:00:00Z", "date_only": false, "value": "2023-12-12T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-12-12T00:00:00Z", "date_only": false, "value": "2023-12-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2023-AVI-1015", "record": "CERTFR-2023-AVI-1015", "field": "revisions.0.revision_date"}, {"timestamp": "2023-12-13T01:20:27.430Z", "date_only": false, "value": "2023-12-13T01:20:27.430843Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-4039", "record": "GSD-2023-4039", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-07T21:27:15Z", "date_only": false, "value": "2024-01-07T21:27:15Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-01-07T21:27:15Z", "date_only": false, "value": "2024-01-07T21:27:15Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-01-07T21:27:15Z", "date_only": false, "value": "2024-01-07T21:27:15Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-01-07T21:27:15Z", "date_only": false, "value": "2024-01-07T21:27:15Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-01-08T23:00:00Z", "date_only": false, "value": "2024-01-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2024-01-09T00:00:00Z", "date_only": false, "value": "2024-01-09T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-01-09T00:00:00Z", "date_only": false, "value": "2024-01-09T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-02-13T00:00:00Z", "date_only": false, "value": "2024-02-13T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-02-13T00:00:00Z", "date_only": false, "value": "2024-02-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-02-19T23:15:07.680Z", "date_only": false, "value": "2024-02-19T23:15:07.680", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-4039", "record": "GSD-2023-4039", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-02-27T23:00:00Z", "date_only": false, "value": "2024-02-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2024-03-12T00:00:00Z", "date_only": false, "value": "2024-03-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2024-03-12T00:00:00Z", "date_only": false, "value": "2024-03-12T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2024-04-09T00:00:00Z", "date_only": false, "value": "2024-04-09T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2024-04-09T00:00:00Z", "date_only": false, "value": "2024-04-09T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2024-05-14T00:00:00Z", "date_only": false, "value": "2024-05-14T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2024-05-14T00:00:00Z", "date_only": false, "value": "2024-05-14T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2024-06-11T00:00:00Z", "date_only": false, "value": "2024-06-11T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2024-06-11T00:00:00Z", "date_only": false, "value": "2024-06-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2024-06-13T22:20:07.881Z", "date_only": false, "value": "2024-06-13T22:20:07.881Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Arm", "record": "CVE-2023-4039", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13235-1", "record": "OPENSUSE-SU-2024:13235-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13235-1", "record": "OPENSUSE-SU-2024:13235-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13235-1", "record": "OPENSUSE-SU-2024:13235-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13235-1", "record": "OPENSUSE-SU-2024:13235-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-06-15T00:00:00Z", "date_only": false, "value": "2024-06-15T00:00:00Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13235-1", "record": "OPENSUSE-SU-2024:13235-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-07-03T00:00:00Z", "date_only": false, "value": "2024-07-03T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2024-07-03T00:00:00Z", "date_only": false, "value": "2024-07-03T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-07-09T00:00:00Z", "date_only": false, "value": "2024-07-09T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2024-07-09T00:00:00Z", "date_only": false, "value": "2024-07-09T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2024-08-02T07:17:11.837Z", "date_only": false, "value": "2024-08-02T07:17:11.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2023-4039", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-13T00:00:00Z", "date_only": false, "value": "2024-08-13T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2024-08-13T00:00:00Z", "date_only": false, "value": "2024-08-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2024-08-15T18:00:00.988Z", "date_only": false, "value": "2024-08-15T18:00:00.988+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2679", "record": "WID-SEC-W-2023-2679", "field": "document.tracking.generator.date"}, {"timestamp": "2024-10-08T00:00:00Z", "date_only": false, "value": "2024-10-08T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2024-10-08T00:00:00Z", "date_only": false, "value": "2024-10-08T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2024-11-12T00:00:00Z", "date_only": false, "value": "2024-11-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2024-11-12T00:00:00Z", "date_only": false, "value": "2024-11-12T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2024-12-10T00:00:00Z", "date_only": false, "value": "2024-12-10T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2024-12-10T00:00:00Z", "date_only": false, "value": "2024-12-10T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2025-01-14T00:00:00Z", "date_only": false, "value": "2025-01-14T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2025-01-14T00:00:00Z", "date_only": false, "value": "2025-01-14T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2025-01-17T11:08:08Z", "date_only": false, "value": "2025-01-17T11:08:08Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2025-1042", "record": "OESA-2025-1042", "field": "published"}, {"timestamp": "2025-02-11T00:00:00Z", "date_only": false, "value": "2025-02-11T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2025-02-11T00:00:00Z", "date_only": false, "value": "2025-02-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2025-02-12T23:00:00Z", "date_only": false, "value": "2025-02-12T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2025-03-11T00:00:00Z", "date_only": false, "value": "2025-03-11T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2025-03-11T00:00:00Z", "date_only": false, "value": "2025-03-11T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2025-04-08T00:00:00Z", "date_only": false, "value": "2025-04-08T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2025-04-08T00:00:00Z", "date_only": false, "value": "2025-04-08T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2025-06-03T16:04:55.934Z", "date_only": false, "value": "2025-06-03T16:04:55.934999Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2023-4039", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-06-03T16:04:55.934Z", "date_only": false, "value": "2025-06-03T16:04:55.934999Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-4039", "record": "FKIE_CVE-2023-4039", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-06-10T00:00:00Z", "date_only": false, "value": "2025-06-10T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2025-06-10T00:00:00Z", "date_only": false, "value": "2025-06-10T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2025-06-18T00:00:00Z", "date_only": true, "value": "2025-06-18", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0524", "record": "CERTFR-2025-AVI-0524", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-06-19T00:00:00Z", "date_only": false, "value": "2025-06-19T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0524", "record": "CERTFR-2025-AVI-0524", "field": "revisions.0.revision_date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.revision_history.17.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.17.date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-08-12T00:00:00Z", "date_only": false, "value": "2025-08-12T00:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-08-14T23:08:55.270Z", "date_only": false, "value": "2025-08-14T23:08:55.270985Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-23-348-10", "record": "ICSA-23-348-10", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-20T15:44:36.252Z", "date_only": false, "value": "2025-08-20T15:44:36.252991Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3lwtrgrwkiq2h", "record": "CVE-2023-4039", "field": "creation_timestamp", "uuid": "792dae02-5871-48f4-9515-c4bfbddd9156", "url": "https://bsky.app/profile/bluesky.awakari.com/post/3lwtrgrwkiq2h"}, {"timestamp": "2025-08-20T15:44:39.380Z", "date_only": false, "value": "2025-08-20T15:44:39.380151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3lwtrguuedx2k", "record": "CVE-2023-4039", "field": "creation_timestamp", "uuid": "82698599-6c1c-46cf-bfed-d25452880fe4", "url": "https://bsky.app/profile/bluesky.awakari.com/post/3lwtrguuedx2k"}, {"timestamp": "2025-08-20T15:48:32.631Z", "date_only": false, "value": "2025-08-20T15:48:32.631104Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3lwtrhf3kwtx2", "record": "CVE-2023-4039", "field": "creation_timestamp", "uuid": "457fd329-4027-4655-a21f-928ee92c9a11", "url": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3lwtrhf3kwtx2"}, {"timestamp": "2025-08-20T22:00:00Z", "date_only": false, "value": "2025-08-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2025-08-20T22:00:00Z", "date_only": false, "value": "2025-08-20T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-08-21T07:15:25.873Z", "date_only": false, "value": "2025-08-21T07:15:25.873+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2351", "record": "WID-SEC-W-2023-2351", "field": "document.tracking.generator.date"}, {"timestamp": "2025-09-04T00:00:00Z", "date_only": true, "value": "2025-09-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0756", "record": "CERTFR-2025-AVI-0756", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-09-05T00:00:00Z", "date_only": false, "value": "2025-09-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0756", "record": "CERTFR-2025-AVI-0756", "field": "revisions.0.revision_date"}, {"timestamp": "2025-10-10T00:00:00Z", "date_only": true, "value": "2025-10-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0864", "record": "CERTFR-2025-AVI-0864", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-10-13T00:00:00Z", "date_only": false, "value": "2025-10-13T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0864", "record": "CERTFR-2025-AVI-0864", "field": "last_revision_date"}, {"timestamp": "2025-10-13T00:00:00Z", "date_only": false, "value": "2025-10-13T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0864", "record": "CERTFR-2025-AVI-0864", "field": "initial_release_date"}, {"timestamp": "2025-10-13T00:00:00Z", "date_only": false, "value": "2025-10-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0864", "record": "CERTFR-2025-AVI-0864", "field": "revisions.0.revision_date"}, {"timestamp": "2025-10-20T00:40:17.994Z", "date_only": false, "value": "2025-10-20T00:40:17.994Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2023-4039", "record": "MSRC_CVE-2023-4039", "field": "document.tracking.generator.date"}, {"timestamp": "2025-11-05T00:00:00Z", "date_only": true, "value": "2025-11-05", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0969", "record": "CERTFR-2025-AVI-0969", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-11-06T00:00:00Z", "date_only": false, "value": "2025-11-06T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0969", "record": "CERTFR-2025-AVI-0969", "field": "last_revision_date"}, {"timestamp": "2025-11-06T00:00:00Z", "date_only": true, "value": "2025-11-06", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0969", "record": "CERTFR-2025-AVI-0969", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2025-11-06T00:00:00Z", "date_only": false, "value": "2025-11-06T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0969", "record": "CERTFR-2025-AVI-0969", "field": "revisions.0.revision_date"}, {"timestamp": "2025-12-01T00:00:00Z", "date_only": true, "value": "2025-12-01", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-1057", "record": "CERTFR-2025-AVI-1057", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-12-02T00:00:00Z", "date_only": false, "value": "2025-12-02T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-1057", "record": "CERTFR-2025-AVI-1057", "field": "last_revision_date"}, {"timestamp": "2025-12-02T00:00:00Z", "date_only": false, "value": "2025-12-02T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-1057", "record": "CERTFR-2025-AVI-1057", "field": "initial_release_date"}, {"timestamp": "2025-12-02T00:00:00Z", "date_only": false, "value": "2025-12-02T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-1057", "record": "CERTFR-2025-AVI-1057", "field": "revisions.0.revision_date"}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-24T00:00:00Z", "date_only": false, "value": "2026-02-24T00:00:00Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-355557", "record": "SSA-355557", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-02-25T07:00:00Z", "date_only": false, "value": "2026-02-25T07:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-25T17:30:49.147Z", "date_only": false, "value": "2026-02-25T17:30:49.147507Z", "kind": "other", "label": "Document generated", "source": "csaf_cisa \u00b7 ICSA-25-226-07", "record": "ICSA-25-226-07", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-23T17:19:09.321Z", "date_only": false, "value": "2026-06-23T17:19:09.321Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2023-4039", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-06T11:06:11Z", "date_only": false, "value": "2026-08-06T11:06:11Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2023-1735", "record": "OESA-2023-1735", "field": "modified"}, {"timestamp": "2026-08-06T11:08:08Z", "date_only": false, "value": "2026-08-06T11:08:08Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2025-1042", "record": "OESA-2025-1042", "field": "modified"}, {"timestamp": "2026-09-20T15:20:36Z", "date_only": false, "value": "2026-09-20T15:20:36Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T15:30:44Z", "date_only": false, "value": "2026-09-20T15:30:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T15:36:27Z", "date_only": false, "value": "2026-09-20T15:36:27Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T20:56:38Z", "date_only": false, "value": "2026-09-20T20:56:38Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T20:56:38Z", "date_only": false, "value": "2026-09-20T20:56:38Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13233-1", "record": "OPENSUSE-SU-2024:13233-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T20:56:39Z", "date_only": false, "value": "2026-09-20T20:56:39Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-11T11:46:33Z", "date_only": false, "value": "2026-10-11T11:46:33Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-11T11:46:33Z", "date_only": false, "value": "2026-10-11T11:46:33Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:3640-1", "record": "SUSE-SU-2023:3640-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-11T11:46:56Z", "date_only": false, "value": "2026-10-11T11:46:56Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-11T11:46:56Z", "date_only": false, "value": "2026-10-11T11:46:56Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2023:4480-1", "record": "SUSE-SU-2023:4480-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-11T11:47:03Z", "date_only": false, "value": "2026-10-11T11:47:03Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-11T11:47:03Z", "date_only": false, "value": "2026-10-11T11:47:03Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2024:0045-1", "record": "SUSE-SU-2024:0045-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-11T11:54:18Z", "date_only": false, "value": "2026-10-11T11:54:18Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-11T11:54:18Z", "date_only": false, "value": "2026-10-11T11:54:18Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:13234-1", "record": "OPENSUSE-SU-2024:13234-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.revision_history.18.date"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-398330", "record": "SSA-398330", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-14T21:23:13.065Z", "date_only": false, "value": "2026-10-14T21:23:13.065Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2023-4039", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T21:23:13.065Z", "date_only": false, "value": "2026-10-14T21:23:13.065Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / siemens-SADP", "record": "CVE-2023-4039", "field": "containers.adp.2.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T22:17:17Z", "date_only": false, "value": "2026-10-14T22:17:17.000", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-4039", "record": "FKIE_CVE-2023-4039", "field": "lastModified"}, {"timestamp": "2026-10-17T09:17:32Z", "date_only": false, "value": "2026-10-17T09:17:32Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2023-4039", "record": "UBUNTU-CVE-2023-4039", "field": "modified"}, {"timestamp": "2026-10-17T09:22:50Z", "date_only": false, "value": "2026-10-17T09:22:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/occam-7/7089a0904cc8d4a42351e5df9b2afe41", "record": "CVE-2023-4039", "field": "creation_timestamp", "uuid": "585d6267-97d4-422a-acea-fe8bde94b39c", "content": "# \u9762\u5411 C \u4e0e C++ \u7684\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u6307\u5357\n\n\u672c\u6587\u662f\u4e00\u4efd\u5173\u4e8e\u7f16\u8bd1\u5668\u4e0e\u94fe\u63a5\u5668\u9009\u9879\u7684\u6307\u5357\uff0c\u8fd9\u4e9b\u9009\u9879\u6709\u52a9\u4e8e\u4f7f\u7528 C \u548c C++ \u7684\u539f\u751f\uff08\u6216\u4ea4\u53c9\uff09\u5de5\u5177\u94fe\u4ea4\u4ed8\u53ef\u9760\u4e14\u5b89\u5168\u7684\u4ee3\u7801\u3002\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u7684\u76ee\u6807\uff0c\u662f\u4ea7\u51fa\u7684\u5e94\u7528\u4e8c\u8fdb\u5236\uff08\u53ef\u6267\u884c\u6587\u4ef6\uff09\u5177\u5907\u62b5\u5fa1\u6f5c\u5728\u653b\u51fb\u548c/\u6216\u5f02\u5e38\u884c\u4e3a\u7684\u5b89\u5168\u673a\u5236\u3002\n\n\u7ecf\u8fc7\u52a0\u56fa\u7684\u7f16\u8bd1\u5668\u9009\u9879\u8fd8\u5e94\u4ea7\u51fa\u80fd\u4e0e\u73b0\u4ee3\u64cd\u4f5c\u7cfb\u7edf\uff08OS\uff09\u65e2\u6709\u5e73\u53f0\u5b89\u5168\u7279\u6027\u826f\u597d\u534f\u4f5c\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\u6709\u6548\u914d\u7f6e\u7f16\u8bd1\u5668\u9009\u9879\u5728\u5f00\u53d1\u671f\u95f4\u8fd8\u6709\u82e5\u5e72\u597d\u5904\uff0c\u4f8b\u5982\u589e\u5f3a\u7684\u7f16\u8bd1\u5668\u8b66\u544a\u3001\u9759\u6001\u5206\u6790\u4e0e\u8c03\u8bd5\u63d2\u6869\u3002\n\n\u672c\u6587\u9762\u5411\uff1a\n\n- \u7f16\u5199 C \u6216 C++ \u4ee3\u7801\u7684\u4eba\uff0c\u5e2e\u52a9\u4ed6\u4eec\u786e\u4fdd\u4ea7\u51fa\u7684\u4ee3\u7801\u5728\u52a0\u56fa\u9009\u9879\u4e0b\u4ecd\u80fd\u6b63\u5e38\u5de5\u4f5c\uff0c\u5305\u62ec\u5d4c\u5165\u5f0f\u8bbe\u5907\u3001\u7269\u8054\u7f51\u8bbe\u5907\u3001\u667a\u80fd\u624b\u673a\u4e0e\u4e2a\u4eba\u7535\u8111\u4e0a\u7684\u573a\u666f\u3002\n- \u4e3a\u751f\u4ea7\u73af\u5883\u6784\u5efa C \u6216 C++ \u4ee3\u7801\u7684\u4eba\uff0c\u5305\u62ec Linux \u53d1\u884c\u7248\u3001\u8bbe\u5907\u5236\u9020\u5546\uff0c\u4ee5\u53ca\u4e3a\u81ea\u5df1\u672c\u5730\u73af\u5883\u7f16\u8bd1 C \u6216 C++ \u7684\u4eba\u3002\n\n\u672c\u6587\u805a\u7126\u4e8e GNU \u7f16\u8bd1\u5668\u96c6\u5408\uff08GCC\uff09\u4e0e Clang/LLVM \u7684\u63a8\u8350\u9009\u9879\uff0c\u6211\u4eec\u9884\u671f\u8fd9\u4e9b\u5efa\u8bae\u540c\u6837\u9002\u7528\u4e8e\u57fa\u4e8e GCC \u4e0e Clang \u6280\u672f\u7684\u5176\u4ed6\u7f16\u8bd1\u5668[1]\u3002\u672a\u6765\u6211\u4eec\u8ba1\u5212\u628a\u6307\u5357\u6269\u5c55\u5230\u5176\u4ed6\u7f16\u8bd1\u5668\uff0c\u4f8b\u5982\u5fae\u8f6f MSVC\u3002\n\n## TL;DR\uff1a\u6211\u5e94\u8be5\u4f7f\u7528\u54ea\u4e9b\u7f16\u8bd1\u5668\u9009\u9879\uff1f\n\n\u5728 GCC \u548c clang \u8fd9\u7c7b\u7f16\u8bd1\u5668\u4e0a\u7f16\u8bd1 C \u6216 C++ \u4ee3\u7801\u65f6\uff0c\u4efb\u4f55\u60c5\u51b5\u4e0b\u90fd\u5e94\u6253\u5f00\u4e0b\u5217\u9009\u9879\uff0c\u4ee5\u4fbf\u5728\u7f16\u8bd1\u671f\u53d1\u73b0\u6f0f\u6d1e\u5e76\u542f\u7528\u8fd0\u884c\u65f6\u4fdd\u62a4\u673a\u5236\uff1a\n\n```\n-O2 -Wall -Wformat -Wformat=2 -Wconversion -Wimplicit-fallthrough \\\n-Werror=format-security \\\n-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 \\\n-D_GLIBCXX_ASSERTIONS \\\n-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST \\\n-fstrict-flex-arrays=3 \\\n-fstack-clash-protection -fstack-protector-strong \\\n-Wl,-z,nodlopen -Wl,-z,noexecstack \\\n-Wl,-z,relro -Wl,-z,now \\\n-Wl,--as-needed -Wl,--no-copy-dt-needed-entries\n```\n\n**\u6b64\u5916**\uff0c\u5f53\u4e0b\u8868\u4e2d\u7684\u4efb\u4e00\u60c5\u5f62\u9002\u7528\u65f6\uff0c\u8fd8\u8981**\u8ffd\u52a0**\u5bf9\u5e94\u7684\u989d\u5916\u9009\u9879\uff1a\n\n- \u4f7f\u7528 GCC \u65f6\uff1a`-Wtrampolines -fzero-init-padding-bits=all`\n- \u4f7f\u7528 GCC \u4e14\u6e90\u7801\u4e2d\u53ea\u5141\u8bb8\u4ece\u5de6\u5230\u53f3\u4e66\u5199\u65f6\uff1a`-Wbidi-chars=any`\n- \u9488\u5bf9\u53ef\u6267\u884c\u6587\u4ef6\uff1a`-fPIE -pie`\n- \u9488\u5bf9\u5171\u4eab\u5e93\uff1a`-fPIC -shared`\n- \u9488\u5bf9 x86_64\uff1a`-fcf-protection=full -fzero-call-used-regs=used-gpr`\n- \u9488\u5bf9 aarch64\uff1a`-mbranch-protection=standard -fzero-call-used-regs=used-gpr`\n- \u9488\u5bf9\u751f\u4ea7\u4ee3\u7801\uff1a`-fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -ftrivial-auto-var-init=zero`\n- \u9488\u5bf9\u628a\u8fc7\u65f6 C \u6784\u9020\u89c6\u4e3a\u9519\u8bef\u7684 C \u4ee3\u7801\uff1a`-Werror=implicit -Werror=incompatible-pointer-types -Werror=int-conversion`\n- \u9488\u5bf9\u4f7f\u7528 GNU C \u5e93 pthreads \u7684\u591a\u7ebf\u7a0b C \u4ee3\u7801\uff1a`-fexceptions`\n- \u5f00\u53d1\u671f\u95f4\u4f46**\u4e0d**\u5728\u5206\u53d1\u6e90\u7801\u65f6\uff1a`-Werror`\n\n\u6ce8\u610f\u67d0\u4e9b\u9009\u9879\u7684\u652f\u6301\u60c5\u51b5\u56e0\u7f16\u8bd1\u5668\u800c\u5f02\uff0c\u4f8b\u5982\n```plaintext\n-D_FORTIFY_SOURCE\n```\n\u7684\u652f\u6301\u7a0b\u5ea6\u53d6\u51b3\u4e8e\u7f16\u8bd1\u5668[2]\u4e0e C \u6807\u51c6\u5e93\u5b9e\u73b0\u3002\u80cc\u666f\u8ba8\u8bba\u89c1\u4e0b\u6587\u201c\u80cc\u666f\u201d\u4e00\u8282\uff0c\u5404\u9009\u9879\u7684\u8be6\u7ec6\u8ba8\u8bba\u89c1\u201c\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u9009\u9879\u201d\u4e00\u8282\u3002\n\n\u6211\u4eec\u5efa\u8bae\u5f00\u53d1\u8005\u5728\u5f00\u53d1\u671f\u95f4\u989d\u5916\u4f7f\u7528\u4e00\u63fd\u5b50\n```plaintext\n-Werror\n```\n\u628a\u6240\u6709\u8b66\u544a\u5f53\u4f5c\u9519\u8bef\u5904\u7406\u3002\u4f46\u5728**\u5206\u53d1**\u6e90\u7801\u65f6**\u4e0d\u5e94**\u4f7f\u7528\u8fd9\u79cd\u4e00\u63fd\u5b50\u5f62\u5f0f\uff0c\u56e0\u4e3a\u8fd9\u6837\u4f7f\u7528 `-Werror` \u4f1a\u9020\u6210\u5bf9\u7279\u5b9a\u5de5\u5177\u94fe\u5382\u5546\u4e0e\u7248\u672c\u7684\u4f9d\u8d56\u3002\u9009\u62e9\u6027\u5f62\u5f0f `-Werror=<warning-flag>` \u9488\u5bf9\u90a3\u4e9b\u5728\u4ee3\u7801\u4e2d\u672c\u4e0d\u8be5\u51fa\u73b0\u7684\u60c5\u5f62\uff0c\u628a\u7279\u5b9a\u8b66\u544a\u63d0\u5347\u4e3a\u9519\u8bef\uff0c\u5b83\u5728\u5f00\u53d1\u671f\u95f4\u4e0e\u5206\u53d1\u6e90\u7801\u65f6\u90fd\u53ef\u4ee5\u4f7f\u7528\u3002\u4f8b\u5982\uff0c\u6211\u4eec\u9f13\u52b1\u5f00\u53d1\u8005\u628a\u5173\u4e8e 1999 \u5e74 C \u6807\u51c6\u5df2\u79fb\u9664\u7684\u8fc7\u65f6 C \u6784\u9020\u7684\u8b66\u544a\u63d0\u5347\u4e3a\u9519\u8bef\uff08\u53c2\u89c1\u4e0a\u8868\u201c\u9488\u5bf9\u628a\u8fc7\u65f6 C \u6784\u9020\u89c6\u4e3a\u9519\u8bef\u201d\u4e00\u884c\uff09\u3002\u8fd9\u4e9b\u9009\u9879\u901a\u5e38\u65e0\u6cd5\u7531\u72ec\u7acb\u6784\u5efa\u8be5\u8f6f\u4ef6\u7684\u4eba\u6dfb\u52a0\uff0c\u56e0\u4e3a\u5b83\u4eec\u53ef\u80fd\u9700\u8981\u5bf9\u6e90\u7801\u505a\u4e0d\u5c0f\u7684\u6539\u52a8\u3002\n\n\u5728\u672c\u6307\u5357\u4e2d\uff0c\u6211\u4eec\u7528\u672f\u8bed_\u751f\u4ea7\u4ee3\u7801_\u6307\u4ee3\u610f\u56fe\u5728\u771f\u5b9e\u4e16\u754c\u4e2d\u4ea7\u751f\u771f\u5b9e\u6548\u679c\u7684\u53ef\u6267\u884c\u4ee3\u7801\uff0c\u5b83\u5e94\u5f53\u5c3d\u53ef\u80fd\u53ef\u9760\u548c\u9ad8\u6027\u80fd\u3002\u6211\u4eec\u7528\u672f\u8bed_\u63d2\u6869\u6d4b\u8bd5\u4ee3\u7801_\u6307\u4ee3\u7ecf\u8fc7\u63d2\u6869\u3001\u4ee5\u63d0\u5347\u7f3a\u9677\u68c0\u51fa\u7387\u4e0e\u53ef\u8c03\u8bd5\u6027\u7684\u53ef\u6267\u884c\u4ee3\u7801\uff0c\u8fd9\u7c7b\u4ee3\u7801\u5f80\u5f80\u5d29\u6e83\u66f4\u591a\u3001\u8fd0\u884c\u66f4\u6162\u3002\u6d4b\u8bd5\u6d41\u7a0b\u5e94\u540c\u65f6\u4f7f\u7528\u63d2\u6869\u6d4b\u8bd5\u4ee3\u7801\u4e0e\u751f\u4ea7\u4ee3\u7801\u3002\n\n\u5f00\u53d1\u8005\u5e94\u786e\u4fdd\u5176\u751f\u4ea7\u4ee3\u7801\u4e0e\u63d2\u6869\u6d4b\u8bd5\u4ee3\u7801\u5728\u542f\u7528\u5168\u90e8\u76f8\u5173\u9009\u9879\u7684\u60c5\u51b5\u4e0b\u90fd\u80fd\u901a\u8fc7\u81ea\u52a8\u5316\u6d4b\u8bd5\u5957\u4ef6\u3002\u6211\u4eec\u9f13\u52b1\u5f00\u53d1\u8005\u628a\u201c\u7a0b\u5e8f\u65e0\u6cd5\u7528\u8fd9\u4e9b\u9009\u9879\u7f16\u8bd1\u201d\u89c6\u4e3a\u7f3a\u9677\u3002\u5982\u679c\u7a0b\u5e8f\u53ea\u5904\u7406\u53ef\u4fe1\u6570\u636e\uff0c\u6784\u5efa\u751f\u4ea7\u4ee3\u7801\u7684\u4eba\u53ef\u4ee5\u9009\u62e9\u7701\u7565\u4e00\u4e9b\u635f\u5bb3\u6027\u80fd\u7684\u52a0\u56fa\u9009\u9879\uff0c\u4f46\u8981\u8bb0\u4f4f\uff1a\u90e8\u7f72\u4e00\u4e2a\u4e0d\u5b89\u5168\u3001\u4f1a\u8fc5\u901f\u505a\u9519\u4e8b\u7684\u7a0b\u5e8f\u5e76\u6ca1\u6709\u597d\u5904\u3002\u65e2\u6709\u7a0b\u5e8f\u53ef\u80fd\u9700\u8981\u968f\u65f6\u95f4\u63a8\u79fb\u9010\u6b65\u4fee\u6539\uff0c\u624d\u80fd\u914d\u5408\u5176\u4e2d\u67d0\u4e9b\u9009\u9879\u5de5\u4f5c\u3002\n\n\u9009\u9879\u80fd\u5e2e\u52a9\u62b5\u5fa1\u90e8\u5206\u653b\u51fb\uff0c\u4f46\u4e0d\u662f\u5168\u90e8\u3002\u5173\u4e8e\u5982\u4f55\u5f00\u53d1\u5b89\u5168\u8f6f\u4ef6\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u53c2\u89c1 OpenSSF \u7684[\u300a\u5f00\u53d1\u66f4\u5b89\u5168\u8f6f\u4ef6\u7684\u7b80\u660e\u6307\u5357\u300b](https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software)\u3002\u5173\u4e8e\u5982\u4f55\u9009\u62e9\u5b89\u5168\u7684\u5f00\u6e90\u8f6f\u4ef6\uff0c\u53c2\u89c1 OpenSSF \u7684[\u300a\u8bc4\u4f30\u5f00\u6e90\u8f6f\u4ef6\u7684\u7b80\u660e\u6307\u5357\u300b](https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software)\u3002\n\n## \u80cc\u666f\n\n### \u4e3a\u4ec0\u4e48\u9700\u8981\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\uff1f\n\n\u9057\u61be\u7684\u662f\uff0c\u5982\u4eca\u653b\u51fb\u8005\u5c31\u5728\u653b\u51fb\u6211\u4eec\u65e5\u5e38\u4f7f\u7528\u7684\u8f6f\u4ef6\u3002\u8bb8\u591a\u7f16\u7a0b\u8bed\u8a00\u7684\u7f16\u8bd1\u5668\u90fd\u63d0\u4f9b\u4e86\u5728\u7f16\u8bd1\u671f\u53d1\u73b0\u6f5c\u5728\u6f0f\u6d1e\u3001\u548c/\u6216\u5728\u8fd0\u884c\u65f6\u63d2\u5165\u9632\u653b\u51fb\u4fdd\u62a4\u673a\u5236\u7684\u9009\u9879\u3002\u8fd9\u5728\u4efb\u4f55\u8bed\u8a00\u4e2d\u90fd\u5f88\u91cd\u8981\uff0c\u800c\u5728 C \u4e0e C++ \u4e2d_\u5c24\u5176_\u91cd\u8981\u3002\n\n\u7528 C \u4e0e C++ \u7f16\u5199\u7684\u5e94\u7528\u7a0b\u5e8f\u5bb9\u6613\u8868\u73b0\u51fa\u4e00\u7c7b\u79f0\u4e3a\u5185\u5b58\u5b89\u5168\u9519\u8bef\u7684\u8f6f\u4ef6\u7f3a\u9677\uff0c\u4e5f\u79f0\u5185\u5b58\u9519\u8bef\u3002\u8fd9\u7c7b\u7f3a\u9677\u5305\u62ec\u7f13\u51b2\u533a\u6ea2\u51fa\u3001\u89e3\u5f15\u7528\u7a7a\u6307\u9488\u3001\u91ca\u653e\u540e\u4f7f\u7528\uff08use-after-free\uff09\u7b49 bug\u3002\u5185\u5b58\u9519\u8bef\u4e4b\u6240\u4ee5\u4f1a\u51fa\u73b0\uff0c\u662f\u56e0\u4e3a C \u4e0e C++ \u7684\u5e95\u5c42\u5185\u5b58\u7ba1\u7406\u5728\u8bed\u8a00\u5c42\u9762\u6ca1\u6709\u63d0\u4f9b\u4efb\u4f55\u4fdd\u969c\uff0c\u6765\u786e\u4fdd\u6307\u9488\u8fd0\u7b97\u6216\u76f4\u63a5\u5185\u5b58\u8bbf\u95ee\u8fd9\u7c7b\u64cd\u4f5c\u7684\u5185\u5b58\u5b89\u5168\u3002\u76f8\u53cd\uff0c\u5b83\u8981\u6c42\u8f6f\u4ef6\u5f00\u53d1\u8005\u5728\u6267\u884c\u5e38\u89c1\u64cd\u4f5c\u65f6\u5199\u51fa\u6b63\u786e\u7684\u4ee3\u7801\uff0c\u800c\u8fd9\u5728\u5927\u89c4\u6a21\u4e0a\u5df2\u88ab\u8bc1\u660e\u5f88\u56f0\u96be\u3002\u5185\u5b58\u9519\u8bef\u6709\u53ef\u80fd\u6f14\u53d8\u4e3a\u5185\u5b58\u6f0f\u6d1e\uff0c\u5a01\u80c1\u884c\u4e3a\u8005\u53ef\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\uff0c\u901a\u8fc7\u8fd0\u884c\u65f6\u653b\u51fb\u672a\u7ecf\u6388\u6743\u5730\u8bbf\u95ee\u8ba1\u7b97\u673a\u7cfb\u7edf\u3002\u5fae\u8f6f\u53d1\u73b0\u5176 2006\u20132018 \u5e74\u95f4\u5168\u90e8\u5b89\u5168\u7f3a\u9677\u4e2d\u6709 70% \u662f\u5185\u5b58\u5b89\u5168\u5931\u6548[3]\uff0cChrome \u56e2\u961f\u540c\u6837\u53d1\u73b0\u5176\u5168\u90e8\u6f0f\u6d1e\u4e2d\u6709 70% \u5c5e\u4e8e\u5185\u5b58\u5b89\u5168\u95ee\u9898\u3002[4]\n\n\u5927\u591a\u6570\u9ad8\u7ea7\u7f16\u7a0b\u8bed\u8a00\u662f_\u201c\u5185\u5b58\u5b89\u5168\u201d_\u7684\uff0c\u9ed8\u8ba4\u5c31\u80fd\u9632\u6b62\u8fd9\u7c7b\u7f3a\u9677\u3002\u5176\u4e2d\u8bb8\u591a\u8bed\u8a00\u5141\u8bb8\u7a0b\u5e8f\u5728\u7279\u6b8a\u60c5\u5f62\u4e0b\u4e34\u65f6\u6302\u8d77\u5185\u5b58\u5b89\u5168\u4fdd\u62a4\uff0c\u4f8b\u5982\u8c03\u7528\u7528 C \u7f16\u5199\u7684\u64cd\u4f5c\u7cfb\u7edf API \u65f6\uff0c\u4f46\u8fd9\u7c7b\u6302\u8d77\u672c\u5e94\u4ec5\u9650\u4e8e\u5c11\u6570\u51e0\u884c\u4ee3\u7801\uff0c\u800c\u4e0d\u662f\u6574\u4e2a\u7a0b\u5e8f\u3002\u4e00\u76f4\u4ee5\u6765\u90fd\u6709\u4eba\u547c\u5401\u7528\u5185\u5b58\u5b89\u5168\u8bed\u8a00\u91cd\u5199 C \u4e0e C++ \u7a0b\u5e8f\u3002\u8fd9\u5728\u67d0\u4e9b\u573a\u666f\u4e2d\u5df2\u7ecf\u53d1\u751f[5]\uff1b\u7136\u800c\u8fd9\u79cd\u91cd\u5199\u6602\u8d35\u3001\u8017\u65f6\uff0c\u672c\u8eab\u5e26\u6709\u98ce\u9669\uff0c\u5728\u4eca\u5929\u6709\u65f6\u5e76\u4e0d\u73b0\u5b9e\uff0c\u5bf9\u4e0d\u5e38\u89c1\u7684 CPU \u5c24\u5176\u5982\u6b64\u3002\u5373\u4fbf\u5404\u65b9\u8fbe\u6210\u5171\u8bc6\uff0c\u91cd\u5199\u5168\u90e8 C \u4e0e C++ \u4ee3\u7801\u4e5f\u8981\u82b1\u4e0a\u6570\u5341\u5e74\uff0c\u5e76\u5e26\u6765\u5de8\u989d\u8d44\u91d1\u6210\u672c\u3002\u6709\u4e00\u4e2a\u7c97\u7565\u4f30\u7b97\u628a\u8fd9\u7c7b\u91cd\u5199\u7684\u6210\u672c\u5b9a\u5728 2.4 \u4e07\u4ebf\u7f8e\u5143[6]\uff0c\u8fd9\u4f1a\u4f7f\u91cd\u5199 C \u4e0e C++ \u6210\u4e3a\u4e0e\u201c\u628a\u5168\u7403\u6c14\u5019\u53d8\u5316\u76ee\u6807\u4fdd\u6301\u5728\u53ef\u53ca\u8303\u56f4\u5185\u201d\u89c4\u6a21\u76f8\u5f53\uff08\u5c31\u6240\u9700\u8d44\u91d1\u6295\u5165\u800c\u8a00\uff09\u7684\u95ee\u9898[7]\u3002\u56e0\u6b64\uff0c\u5e76\u975e\u6240\u6709 C \u4e0e C++ \u4ee3\u7801\u90fd\u80fd\u88ab\u6539\u5199\u6216\u4e22\u5f03[8]\u3002\u4f8b\u5982\u8c37\u6b4c\u9884\u8ba1_\u201c\u5728\u53ef\u9884\u89c1\u7684\u672a\u6765\uff0c\u4ecd\u4f1a\u6b8b\u7559\u4e00\u5b9a\u6570\u91cf\u6210\u719f\u7a33\u5b9a\u7684\u975e\u5185\u5b58\u5b89\u5168\u4ee3\u7801\u201d_[9]\u3002\n\n\u56e0\u6b64\uff0c\u91cd\u8981\u7684\u662f\u63a5\u53d7 C \u4e0e C++ \u4f1a\u7ee7\u7eed\u88ab\u4f7f\u7528\u8fd9\u4e00\u73b0\u5b9e\uff0c\u5e76\u91c7\u53d6_\u5176\u4ed6_\u63aa\u65bd\u6765\u964d\u4f4e\u98ce\u9669\u3002\u8981\u964d\u4f4e\u98ce\u9669\uff0c\u6211\u4eec\u5fc5\u987b\u964d\u4f4e\u7f3a\u9677\u6f14\u53d8\u4e3a\u6f0f\u6d1e\u7684\u53ef\u80fd\u6027\uff0c\u6216\u964d\u4f4e\u8fd9\u7c7b\u7f3a\u9677\u7684\u5f71\u54cd\u3002\u79ef\u6781\u4f7f\u7528\u7f16\u8bd1\u5668\u9009\u9879\uff0c\u6709\u65f6\u80fd\u53d1\u73b0\u6f0f\u6d1e\uff0c\u6216\u5e2e\u52a9\u62b5\u6d88\u5176\u8fd0\u884c\u65f6\u5f71\u54cd\u3002\n\n\u8fd0\u884c\u65f6\u653b\u51fb\u4e0d\u540c\u4e8e\u4f20\u7edf\u6076\u610f\u8f6f\u4ef6\uff1a\u540e\u8005\u901a\u8fc7\u4e00\u4e2a\u4e13\u95e8\u7684\u6076\u610f\u53ef\u6267\u884c\u7a0b\u5e8f\u6765\u5b9e\u65bd\u6076\u610f\u884c\u4e3a\uff0c\u800c\u8fd0\u884c\u65f6\u653b\u51fb\u662f\u5f71\u54cd\u826f\u6027\u7a0b\u5e8f\u4f7f\u5176\u8868\u73b0\u6076\u610f\u3002\u5229\u7528\u672a\u7f13\u89e3\u7684\u5185\u5b58\u6f0f\u6d1e\u7684\u8fd0\u884c\u65f6\u653b\u51fb\uff0c\u53ef\u88ab\u5a01\u80c1\u884c\u4e3a\u8005\u5f53\u4f5c\u521d\u59cb\u653b\u51fb\u5411\u91cf\uff0c\u501f\u4ee5\u5728\u7cfb\u7edf\u4e0a\u7acb\u8db3\uff0c\u4f8b\u5982\u5411\u8fd0\u884c\u4e2d\u7684\u7a0b\u5e8f\u6ce8\u5165\u6076\u610f\u4ee3\u7801\u3002\n\n\u73b0\u4ee3\u7684\u5b89\u5168\u610f\u8bc6\u8f83\u5f3a\u7684 C \u4e0e C++ \u8f6f\u4ef6\u5f00\u53d1\u5b9e\u8df5\uff0c\u4f8b\u5982 SEI CERT C[10] \u4e0e C++[11] \u8fd9\u7c7b\u5b89\u5168\u7f16\u7801\u6807\u51c6\uff0c\u4ee5\u53ca\u7a0b\u5e8f\u5206\u6790\uff0c\u65e8\u5728\u4e3b\u52a8\u907f\u514d\u628a\u5185\u5b58\u9519\u8bef\uff08\u53ca\u5176\u4ed6\u8f6f\u4ef6\u7f3a\u9677\uff09\u5f15\u5165\u5e94\u7528\u7a0b\u5e8f\u3002\u7136\u800c\u5728\u5b9e\u8df5\u4e2d\uff0c\u5f7b\u5e95\u6839\u9664\u751f\u4ea7\u73af\u5883 C \u4e0e C++ \u8f6f\u4ef6\u4e2d\u7684\u5185\u5b58\u9519\u8bef\u5df2\u88ab\u8bc1\u660e\u8fd1\u4e4e\u4e0d\u53ef\u80fd\u3002\n\n\u56e0\u6b64\uff0c\u73b0\u4ee3\u64cd\u4f5c\u7cfb\u7edf\uff08\u5305\u62ec\u5176 C \u4e0e C++ \u7f16\u8bd1\u5668\u4ee5\u53ca\u8fd0\u884c\u65f6\u57fa\u7840\u8bbe\u65bd\uff09\u90e8\u7f72\u4e86\u5404\u79cd\u8fd0\u884c\u65f6\u673a\u5236\u6765\u9632\u5fa1\u6f5c\u5728\u5b89\u5168\u7f3a\u9677\u3002\u8fd9\u7c7b\u673a\u5236\u7684\u4e3b\u8981\u76ee\u7684\uff0c\u662f\u7f13\u89e3\u53ef\u80fd\u88ab\u5229\u7528\u7684\u5185\u5b58\u6f0f\u6d1e\uff0c\u4f7f\u5a01\u80c1\u884c\u4e3a\u8005\u65e0\u6cd5\u5229\u7528\u5b83\u4eec\u83b7\u5f97\u4ee3\u7801\u6267\u884c\u80fd\u529b\u3002\u6709\u4e86\u7f13\u89e3\u63aa\u65bd\uff0c\u89e6\u53d1\u5185\u5b58\u9519\u8bef\u7684\u5e94\u7528\u4ecd\u53ef\u80fd\u5d29\u6e83\u3002\u4f46\u5982\u679c\u53e6\u4e00\u79cd\u7ed3\u679c\u662f\u7cfb\u7edf\u8fd0\u884c\u65f6\u73af\u5883\u88ab\u653b\u9677\uff0c\u90a3\u4e48\u5d29\u6e83\u4ecd\u662f\u66f4\u53ef\u53d6\u7684\u7ed3\u679c\u3002\n\n\u8fd9\u4e9b\u8fd0\u884c\u65f6\u673a\u5236\u5728\u542f\u7528\u540e_\u80fd_\u963b\u6b62\u653b\u51fb\u3001\u964d\u4f4e\u653b\u51fb\u53ef\u80fd\u6027\u6216\u51cf\u8f7b\u653b\u51fb\u5f71\u54cd\u3002[12]\n\n\u8981\u4ece\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u7684\u4fdd\u62a4\u673a\u5236\u4e2d\u53d7\u76ca\uff0c\u5e94\u7528\u4e8c\u8fdb\u5236\u5fc5\u987b\u5728\u6784\u5efa\u671f\u5c31\u51c6\u5907\u597d\u4e0e\u8fd9\u4e9b\u7f13\u89e3\u63aa\u65bd\u517c\u5bb9\u3002\u901a\u5e38\u8fd9\u610f\u5473\u7740\u5728\u6784\u5efa\u8f6f\u4ef6\u65f6\u4e3a\u7f16\u8bd1\u5668\u6216\u94fe\u63a5\u5668\u542f\u7528\u7279\u5b9a\u9009\u9879\u3002\n\n\u6709\u4e9b\u673a\u5236\u53ef\u80fd\u9700\u8981\u989d\u5916\u914d\u7f6e\u4e0e\u7ec6\u81f4\u8c03\u4f18\uff0c\u4f8b\u5982\u56e0\u4e3a\u67d0\u4e9b\u7f55\u89c1\u8fb9\u754c\u60c5\u5f62\u4e0b\u53ef\u80fd\u51fa\u73b0\u7f16\u8bd1\u95ee\u9898\uff0c\u6216\u8be5\u7f13\u89e3\u63aa\u65bd\u5bf9\u67d0\u4e9b\u7a0b\u5e8f\u6784\u9020\u5e26\u6765\u6027\u80fd\u5f00\u9500\u3002\u6709\u4e9b\u7f16\u8bd1\u5668\u5b89\u5168\u7279\u6027\u4f9d\u8d56\u7a0b\u5e8f\u7684\u6570\u636e\u6d41\u5206\u6790\u4e0e\u542f\u53d1\u5f0f\u5224\u65ad\uff0c\u5176\u7ed3\u679c\u53ef\u80fd\u56e0\u6e90\u7801\u7ec6\u8282\u800c\u5f02\u3002\u56e0\u6b64\uff0c\u8fd9\u4e9b\u7279\u6027\u5b9e\u73b0\u7684\u4fdd\u62a4\u673a\u5236\u672a\u5fc5\u603b\u80fd\u63d0\u4f9b\u5b8c\u6574\u8986\u76d6\u3002\n\n\u5728\u4f9d\u8d56\u8fc7\u65f6\u7248\u672c\u5f00\u6e90\u8f6f\u4ef6\uff08OSS\uff09\u7f16\u8bd1\u5668\u7684\u9879\u76ee\u4e2d\uff0c\u8fd9\u4e9b\u95ee\u9898\u4f1a\u66f4\u4e25\u91cd\u3002\u603b\u4f53\u800c\u8a00\uff0cLinux \u53d1\u884c\u7248\u6240\u9644\u5e26\u7684\u73b0\u4ee3\u7248\u672c\u7f16\u8bd1\u5668\u66f4\u53ef\u80fd\u9ed8\u8ba4\u542f\u7528\u5b89\u5168\u7f13\u89e3\u63aa\u65bd\u3002\u6ce8\u610f\u4e0a\u6e38 GCC \u9879\u76ee\u81ea\u8eab\u7684\u9ed8\u8ba4\u8bbe\u7f6e\u5e76\u4e0d\u542f\u7528\u5176\u4e2d\u67d0\u4e9b\u7f13\u89e3\u63aa\u65bd\u3002\n\n\u5982\u679c\u6784\u5efa\u671f\u5ffd\u89c6\u6216\u9057\u6f0f\u4e86\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\uff0c\u90a3\u4e48\u5df2\u7ecf\u5206\u53d1\u7684\u53ef\u6267\u884c\u6587\u4ef6\u5c31\u65e0\u6cd5\u518d\u8865\u4e0a\u52a0\u56fa\u3002\u56e0\u6b64\u826f\u597d\u7684\u505a\u6cd5\u662f\uff1a\u8bc4\u4f30\u5e94\u7528\u7a0b\u5e8f\u5e94\u652f\u6301\u54ea\u4e9b\u7f13\u89e3\u63aa\u65bd\uff0c\u5e76\u5728\u4e0d\u542f\u7528\u67d0\u9879\u7f13\u89e3\u4f1a\u524a\u5f31\u5e94\u7528\u9632\u5fa1\u59ff\u6001\u65f6\uff0c\u505a\u51fa\u81ea\u89c9\u7684\u3001\u6709\u4f9d\u636e\u7684\u51b3\u5b9a\u3002\u786e\u4fdd\u8f6f\u4ef6\u5728\u5c3d\u53ef\u80fd\u591a\u7684\u9009\u9879\u4e0b\u90fd\u7ecf\u8fc7_\u6d4b\u8bd5_\uff0c\u4ee5\u4fdd\u8bc1\u5b83\u80fd\u4ee5\u90a3\u79cd\u65b9\u5f0f\u8fd0\u884c\u3002\n\n\u4e00\u4e9b\u7ec4\u7ec7\u8981\u6c42\u9009\u53d6\u52a0\u56fa\u89c4\u5219\u3002\u4f8b\u5982\u7f8e\u56fd\u653f\u5e9c NIST SP 800-218 \u7684\u5b9e\u8df5 PW.6 \u8981\u6c42\u914d\u7f6e\u201c\u7f16\u8bd1\u3001\u89e3\u91ca\u5668\u4e0e\u6784\u5efa\u8fc7\u7a0b\u4ee5\u63d0\u5347\u53ef\u6267\u884c\u6587\u4ef6\u5b89\u5168\u6027\u201d[13]\u3002\u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\uff08CMU\uff09\u7684\u201c\u5341\u5927\u5b89\u5168\u7f16\u7801\u5b9e\u8df5\u201d\u5efa\u8bae\u201c\u4f7f\u7528\u7f16\u8bd1\u5668\u53ef\u7528\u7684\u6700\u9ad8\u8b66\u544a\u7ea7\u522b\u7f16\u8bd1\u4ee3\u7801\uff0c\u5e76\u901a\u8fc7\u4fee\u6539\u4ee3\u7801\u6d88\u9664\u8b66\u544a\u201d\u3002[14] \u672c\u6307\u5357\u53ef\u4ee5\u5e2e\u52a9\u4f60\u505a\u5230\u8fd9\u4e00\u70b9\u3002\n\n### \u672c\u6307\u5357\u5e94\u5982\u4f55\u5e94\u7528\uff1f\n\n\u5982\u4f55\u5e94\u7528\u672c\u6307\u5357\u53d6\u51b3\u4e8e\u4f60\u7684\u5904\u5883\uff1a\n\n- \u65b0\u5efa\u6216\u63a5\u8fd1\u65b0\u5efa\u7684\u9879\u76ee\uff08\u201c\u7eff\u5730\u201d\uff09\uff1a\u5982\u679c\u4f60\u6b63\u5728\u542f\u52a8\u65b0\u9879\u76ee\uff0c\u5c3d\u5feb\u542f\u7528\u5168\u90e8\u9009\u9879\uff0c\u6700\u597d\u5728\u4efb\u4f55\u4ee3\u7801\u5199\u51fa\u6765\u4e4b\u524d\u3002\u8fd9\u6837\u4f60\u80fd\u7acb\u5373\u6536\u5230\u4efb\u4f55\u6709\u95ee\u9898\u6784\u9020\u7684\u901a\u77e5\uff0c\u5e76\u5728\u5c06\u6765\u907f\u514d\u5b83\u4eec\u3002\n- \u65e2\u6709\u7684\u975e\u5e73\u51e1\u9879\u76ee\uff08\u201c\u68d5\u5730\u201d\uff09\uff1a\u4e00\u6b21\u6027\u542f\u7528\u5168\u90e8\u9009\u9879\u901a\u5e38\u4e0d\u73b0\u5b9e\u3002\u9996\u5148\uff0c\u8b66\u544a\u6570\u91cf\u5927\u6982\u4f1a\u591a\u5230\u96be\u4ee5\u627f\u53d7\u3002\u5176\u6b21\uff0c\u867d\u7136\u8fd0\u884c\u65f6\u4fdd\u62a4\u673a\u5236\u901a\u5e38\u4e0d\u4f1a\u8ba9\u6b63\u786e\u8fd0\u884c\u7684\u7a0b\u5e8f\u5931\u8d25\uff0c\u4f46\u4ecd\u53ef\u80fd\u5f15\u53d1\u95ee\u9898\uff08\u4f8b\u5982\u4e8c\u8fdb\u5236\u4f53\u79ef\u589e\u5927\uff09\u3002\u76f8\u53cd\uff0c\u5e94\u4e00\u6b21\u542f\u7528\u4e00\u4e2a\u6216\u5c11\u6570\u51e0\u4e2a\u9009\u9879\uff0c\u8bc4\u4f30\u5176\u5f71\u54cd\uff0c\u89e3\u51b3\u51fa\u73b0\u7684\u95ee\u9898\uff0c\u7136\u540e\u968f\u65f6\u95f4\u91cd\u590d\u3002\u6709\u4e9b\u9009\u9879\uff08\u5982 `-Wall`\uff09\u662f\u5176\u4ed6\u9009\u9879\u7684\u96c6\u5408\uff1b\u53ef\u4ee5\u8003\u8651\u628a\u5b83\u4eec\u62c6\u5f00\uff0c\u4e00\u6b21\u542f\u7528\u5176\u4e2d\u51e0\u4e2a\u5177\u4f53\u9009\u9879\u3002\n\n\u5e94\u7528\u7a0b\u5e8f\u5e94\u671d\u7740\u65e0\u8b66\u544a\u7f16\u8bd1\u7684\u76ee\u6807\u52aa\u529b\u3002\u8fd9\u9700\u8981\u65f6\u95f4\uff0c\u4f46\u8b66\u544a\u6307\u793a\u7740\u6f5c\u5728\u95ee\u9898\u3002\u4e00\u65e6\u505a\u5230\uff0c\u4efb\u4f55\u65b0\u51fa\u73b0\u7684\u8b66\u544a\u90fd\u6307\u793a\u7740\u6f5c\u5728\u95ee\u9898\u3002\n\n\u6211\u4eec\u9f13\u52b1\u5f00\u53d1\u8005\u59cb\u7ec8\u4f7f\u7528\u6807\u51c6\u6240\u4fdd\u8bc1\u7684\u65b9\u5f0f\u53bb\u505a\u4e8b\uff0c\u53ea\u8981\u5176\u6784\u5efa\u6d41\u7a0b\u652f\u6301\u3002\u4f8b\u5982\u5728 C23 \u6216 C++ \u4e2d\uff0c\u628a\n```plaintext\n{}\n```\n\u8d4b\u7ed9\u8054\u5408\u4f53\u53ef\u4fdd\u8bc1\u6e05\u9664\u6574\u4e2a\u8054\u5408\u4f53\uff08\u5305\u62ec\u586b\u5145\u4f4d\uff09\uff08\u9759\u6001\u5b58\u50a8\u671f\u521d\u59cb\u5316\u9664\u5916\uff09\u3002\u628a\n```plaintext\n{0}\n```\n\u8d4b\u7ed9\u8054\u5408\u4f53\u5219\u4e0d\u4fdd\u8bc1\u6e05\u9664\u6574\u4e2a\u8054\u5408\u4f53\uff08\u4f8b\u5982\u5728 GCC 14 \u53ca\u66f4\u65e9\u7248\u672c\u4e2d\u8fd9\u4f1a\u6e05\u9664\u8054\u5408\u4f53\uff0c\u4f46\u5728 GCC 15 \u4e2d\u4e0d\u4f1a[15]\uff09\u3002\u91c7\u7528\u6807\u51c6\u505a\u6cd5\u80fd\u5927\u5e45\u964d\u4f4e\u56e0\u6362\u7528\u4e0d\u540c\u7f16\u8bd1\u5668\u6216\u4e0d\u540c\u7f16\u8bd1\u5668\u7248\u672c\u800c\u51fa\u95ee\u9898\u7684\u98ce\u9669\u3002\u8bdd\u867d\u5982\u6b64\uff0c\u6807\u51c6\u4e2d\u53ef\u80fd\u6ca1\u6709\u786e\u4fdd\u67d0\u9879\u7279\u5b9a\u5c5e\u6027\u7684\u673a\u5236\uff0c\u6709\u65f6\u7f16\u8bd1\u5668\u5e76\u672a\u5b9e\u73b0\u6807\u51c6\u505a\u6cd5\uff0c\u5f00\u53d1\u8005\u6709\u65f6\u4e5f\u4f1a\u72af\u9519\u3002\u56e0\u6b64\uff0c\u5728\u5b9e\u9645\u53ef\u884c\u65f6\uff0c\u5728\u6807\u51c6\u4e4b\u5185\u884c\u4e8b\u5e76\u8f85\u4ee5\u9009\u9879\uff0c\u662f\u4e00\u79cd\u5f3a\u6709\u529b\u7684\u7ec4\u5408\u3002\n\n### \u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u4e0d\u505a\u4ec0\u4e48\uff1f\n\n\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u4e0d\u662f\u94f6\u5f39\uff1b\u4ec5\u4f9d\u8d56\u5b89\u5168\u7279\u6027\u4e0e\u5b89\u5168\u529f\u80fd\u5e76\u4e0d\u8db3\u4ee5\u5b9e\u73b0\u5b89\u5168\u8f6f\u4ef6\u3002\u5b89\u5168\u6027\u662f\u6574\u4e2a\u7cfb\u7edf\u7684\u6d8c\u73b0\u5c5e\u6027\uff0c\u4f9d\u8d56\u5404\u90e8\u5206\u88ab\u6b63\u786e\u5730\u6784\u5efa\u4e0e\u96c6\u6210\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u4f7f\u7528\u5f97\u5f53\uff0c\u5b89\u5168\u7f16\u8bd1\u5668\u9009\u9879\u4f1a\u8865\u5145\u65e2\u6709\u6d41\u7a0b\uff0c\u4f8b\u5982\u9759\u6001\u4e0e\u52a8\u6001\u5206\u6790\u3001\u5b89\u5168\u7f16\u7801\u5b9e\u8df5\u3001\u8d1f\u5411\u6d4b\u8bd5\u5957\u4ef6\u3001\u6027\u80fd\u5256\u6790\u5de5\u5177\uff0c\u4ee5\u53ca\u6700\u91cd\u8981\u7684\uff1a\u4f5c\u4e3a\u624e\u5b9e\u8bbe\u8ba1\u4e0e\u67b6\u6784\u4e00\u90e8\u5206\u7684\u5b89\u5168\u536b\u751f\u3002\n\n\u5728\u591a\u6570\u60c5\u51b5\u4e0b\uff0c\u52a0\u56fa\u7684\u7f16\u8bd1\u5668\u9009\u9879\u53ea\u5bf9\u7528\u52a0\u56fa\u9009\u9879\u7f16\u8bd1\u7684\u4ee3\u7801\u751f\u6548\u3002\u56e0\u6b64\uff0c\u5927\u90e8\u5206\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u4e0d\u4f1a\u60e0\u53ca\u5728\u91c7\u7528\u52a0\u56fa\u9009\u9879\u4e4b\u524d\u5c31\u5df2\u9884\u6784\u5efa\u7684\u8f6f\u4ef6\u3002\u5bf9\u4e8e\u96c6\u6210\u4e86\u9884\u6784\u5efa\uff08\u53ef\u80fd\u662f\u7b2c\u4e09\u65b9\uff09\u5e93\u6216\u5176\u4ed6\u7ec4\u4ef6\u7684\u9879\u76ee\uff0c\u8fd9\u5c24\u5176\u503c\u5f97\u5173\u6ce8\u3002\u6b64\u7c7b\u60c5\u51b5\u4e0b\uff0c\u91cd\u8981\u7684\u662f\u5f04\u6e05\u9879\u76ee\u94fe\u63a5\u4e86\u54ea\u4e9b\u7ec4\u4ef6\u3001\u8fd9\u4e9b\u7ec4\u4ef6\u53c8\u662f\u5982\u4f55\u6784\u5efa\u7684\uff0c\u4ece\u800c\u786e\u5b9a\u54ea\u4e9b\u7ec4\u4ef6\u80fd\u4ece\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u4e2d\u53d7\u76ca\u3002\n\n### \u6211\u4eec\u7684\u5a01\u80c1\u6a21\u578b\u3001\u76ee\u6807\u4e0e\u76ee\u7684\u662f\u4ec0\u4e48\uff1f\n\n\u6211\u4eec\u7684\u5a01\u80c1\u6a21\u578b\u662f\uff1a\u6240\u6709\u8f6f\u4ef6\u5f00\u53d1\u8005\u90fd\u4f1a\u72af\u9519\uff0c\u6709\u65f6\u8fd9\u4e9b\u9519\u8bef\u4f1a\u5bfc\u81f4\u6f0f\u6d1e\u3002\u6b64\u5916\uff0c\u67d0\u4e9b\u6076\u610f\u5f00\u53d1\u8005\u53ef\u80fd\u6545\u610f\u5199\u51fa_\u770b\u8d77\u6765_\u50cf\u65e0\u610f\u6f0f\u6d1e\u7684\u4ee3\u7801\uff0c\u6216_\u770b\u8d77\u6765_\u6b63\u786e\u4f46\u6709\u610f\u6b3a\u9a97\u8bc4\u5ba1\u8005\u7684\u4ee3\u7801\uff08\u5373\u9634\u624b\u4ee3\u7801 underhanded code[16]\uff09\u3002\n\n\u6211\u4eec\u7684\u9996\u8981\u76ee\u6807\u662f\u62b5\u5fa1_\u770b\u8d77\u6765_\u65e0\u610f\u7684\u6f0f\u6d1e\uff08\u65e0\u8bba\u5176\u662f\u5426\u771f\u4e3a\u65e0\u610f\uff09\u3002\u6b21\u8981\u76ee\u6807\u662f\u62b5\u5fa1\u90a3\u4e9b\u6e90\u7801\u5916\u89c2\u88ab\u8bbe\u8ba1\u6210\u6b3a\u9a97\u8bc4\u5ba1\u8005\u7684\u6076\u610f\u4ee3\u7801\u3002\n\n\u8bb8\u591a\u6f0f\u6d1e\u7531\u5e38\u89c1\u9519\u8bef\u9020\u6210\u3002\u56e0\u6b64\u5728\u5b9e\u73b0\u8fd9\u4e9b\u76ee\u6807\u65f6\uff0c\u6211\u4eec\u5f88\u5927\u4e00\u90e8\u5206\u6ce8\u610f\u529b\u653e\u5728\u53d1\u73b0\u5e76\u62b5\u5fa1_\u5e38\u89c1_\u9519\u8bef\u4e0a\uff0c\u65e0\u8bba\u5b83\u4eec\u5728\u7279\u5b9a\u60c5\u5f62\u4e0b\u662f\u5426\u6784\u6210\u6f0f\u6d1e\u3002\u6211\u4eec\u5c24\u5176\uff08\u4f46\u4e0d\u9650\u4e8e\uff09\u5173\u6ce8\u62b5\u5fa1\u5185\u5b58\u5b89\u5168\u95ee\u9898\uff0c\u56e0\u4e3a\u5982\u4e0a\u6240\u8ff0\uff0c\u5185\u5b58\u5b89\u5168\u95ee\u9898\u9020\u6210\u4e86 C \u4e0e C++ \u4ee3\u7801\u4e2d\u7684\u5927\u591a\u6570\u6f0f\u6d1e\u3002\n\n\u6211\u4eec_\u4e0d_\u8bd5\u56fe\u62b5\u5fa1\u90a3\u4e9b\u6e90\u7801\u660e\u663e\u662f\u6076\u610f\u7f16\u5199\u7684\u8f6f\u4ef6\u3002\u7f16\u8bd1\u5668\u4e00\u822c\u65e0\u6cd5\u62b5\u5fa1\u8fd9\u79cd\u60c5\u51b5\uff0c\u5176\u4ed6\u5bf9\u7b56\uff08\u5982\u6e90\u7801\u540c\u884c\u8bc4\u5ba1\uff09\u66f4\u4e3a\u6709\u6548\u3002\n\n\u57fa\u4e8e\u8fd9\u4e9b\u76ee\u6807\uff0c\u672c\u6307\u5357\u6709\u4ee5\u4e0b\u76ee\u7684\uff1a\n\n- _\u6700\u5c0f\u5316_\u751f\u4ea7\u4ee3\u7801\u4e2d\u53d1\u5e03\u7684\u6f0f\u6d1e\u7684\u53ef\u80fd\u6027\u4e0e/\u6216\u5f71\u54cd\u3002\n- _\u6700\u5927\u5316_\u5728\u7f16\u8bd1\u671f\u6216\u6d4b\u8bd5\u671f\uff08\u5c24\u5176\u662f\u4f7f\u7528\u63d2\u6869\u6d4b\u8bd5\u4ee3\u7801\u65f6\uff09\u53d1\u73b0\u6f0f\u6d1e\uff0c\u4f7f\u5176\u80fd\u5728\u53d1\u5e03\u524d\u4fee\u590d\u3002\n- \u5728\u5b9e\u9645\u53ef\u884c\u65f6\u53d1\u73b0\u9634\u624b\u4ee3\u7801[16]\uff08\u5c24\u5176\u662f\u6728\u9a6c\u6e90\u7801 Trojan source[17]\uff09\uff0c\u4f7f\u540c\u884c\u8bc4\u5ba1\u66f4\u6709\u6548\u3002\n\n\u672c\u6307\u5357\u65e0\u6cd5\u4fdd\u8bc1\u8fd9\u4e9b\u7ed3\u679c\u3002\u4f46\u4e0e\u5176\u4ed6\u63aa\u65bd\u7ed3\u5408\u65f6\uff0c\u5b83\u4eec\u80fd\u63d0\u4f9b\u663e\u8457\u5e2e\u52a9\u3002\n\n## \u63a8\u8350\u7684\u7f16\u8bd1\u5668\u9009\u9879\n\n\u672c\u8282\u63cf\u8ff0\u5173\u4e8e\u7f16\u8bd1\u5668\u4e0e\u94fe\u63a5\u5668\u9009\u9879\u7684\u5efa\u8bae\uff0c\u8fd9\u4e9b\u9009\u9879 1) \u542f\u7528\u7f16\u8bd1\u671f\u68c0\u67e5\uff0c\u5c31\u6e90\u7801\u4e2d\u7684\u6f5c\u5728\u7f3a\u9677\u5411\u5f00\u53d1\u8005\u53d1\u51fa\u8b66\u544a\uff08\u8868 1\uff09\uff0c2) \u542f\u7528\u8fd0\u884c\u65f6\u4fdd\u62a4\u673a\u5236\uff0c\u4f8b\u5982\u7528\u4e8e\u68c0\u6d4b\u5e94\u7528\u7a0b\u5e8f\u5185\u5b58\u6f0f\u6d1e\u4f55\u65f6\u88ab\u5229\u7528\u7684\u68c0\u67e5\uff08\u8868 2\uff09\u3002\n\n\u8868 1 \u4e0e\u8868 2 \u4e2d\u7684\u5efa\u8bae\u4e3b\u8981\u9002\u7528\u4e8e\u5728 GNU/Linux \u73af\u5883\u4e2d\u4f7f\u7528 GCC \u4e0e Binutils \u5de5\u5177\u94fe\u6216 Clang/LLVM \u5de5\u5177\u94fe\u7f16\u8bd1\u7528\u6237\u7a7a\u95f4\u4ee3\u7801\uff0c\u4e4b\u6240\u4ee5\u6536\u5f55\u4e8e\u672c\u6587\uff0c\u662f\u56e0\u4e3a\u5b83\u4eec\uff1a\n\n- \u88ab\u5e7f\u6cdb\u90e8\u7f72\uff0c\u4e14\u81f3\u5c11\u5728\u67d0\u4e9b\u4e3b\u6d41 Linux \u53d1\u884c\u7248\uff08\u5305\u62ec Debian\u3001Ubuntu\u3001Red Hat \u4e0e SUSE Linux\uff09\u4e2d\u5df2\u5bf9\u9884\u6784\u5efa\u8f6f\u4ef6\u5305\u9ed8\u8ba4\u542f\u7528\u3002\u53c2\u89c1 Voisin \u7b49\u4eba\u5bf9\u53d1\u884c\u7248\u6240\u7528\u7f16\u8bd1\u5668\u9009\u9879\u7684\u6301\u7eed\u8c03\u67e5[18]\u3002\n- \u540c\u65f6\u53d7 GCC \u4e0e Clang/LLVM \u5de5\u5177\u94fe\u652f\u6301\u3002\n- \u8de8\u5e73\u53f0\uff0c\u81f3\u5c11\u5728 Intel \u4e0e AMD 64 \u4f4d x86 \u67b6\u6784\u4ee5\u53ca ARM \u67b6\u6784\u7684 64 \u4f4d\u7248\u672c\uff08AArch64\uff09\u4e0a\u53d7\u652f\u6301\u3002\n\n\u672c\u6307\u5357\u6d89\u53ca\u7684\u94fe\u63a5\u5668\u9009\u9879\uff08\u9664\u975e\u53e6\u6709\u8bf4\u660e\uff09\u5bf9\u4f5c\u4e3a GNU \u4e8c\u8fdb\u5236\u5de5\u5177\uff08binutils\uff09\u4e00\u90e8\u5206\u63d0\u4f9b\u3001\u57fa\u4e8e GNU BFD\uff08\u4e8c\u8fdb\u5236\u6587\u4ef6\u63cf\u8ff0\u7b26\uff09\u5e93\u6784\u5efa\u7684 GNU \u94fe\u63a5\u5668\uff08LD\uff09\u6709\u6548\u3002\u5b83\u4eec\u5bf9\u5176\u4ed6\u94fe\u63a5\u5668\uff08\u5982 binutils gold \u6216 LLVM \u94fe\u63a5\u5668 LLD\uff09\u53ef\u80fd\u4e0d\u662f\u6709\u6548\u9009\u9879\u3002\n\n\u51fa\u4e8e\u5386\u53f2\u539f\u56e0\uff0cGCC \u7f16\u8bd1\u5668\u4e0e Binutils \u4e0a\u6e38\u9879\u76ee\u9ed8\u8ba4\u4e0d\u542f\u7528\u4f18\u5316\u6216\u5b89\u5168\u52a0\u56fa\u9009\u9879\u3002\u867d\u7136\u4ece\u6e90\u7801\u6784\u5efa GCC \u4e0e Binutils \u65f6\u53ef\u4ee5\u6539\u53d8\u9ed8\u8ba4\u9009\u9879\u7684\u67d0\u4e9b\u65b9\u9762\uff0c\u4f46 GNU/Linux \u53d1\u884c\u7248\u6240\u9644\u5e26\u5de5\u5177\u94fe\u4f7f\u7528\u7684\u9ed8\u8ba4\u503c\u5404\u4e0d\u76f8\u540c\u3002\u53d1\u884c\u7248\u8fd8\u53ef\u80fd\u63d0\u4f9b\u591a\u4e2a\u9ed8\u8ba4\u503c\u4e0d\u540c\u7684\u5de5\u5177\u94fe\u7248\u672c\u3002\u56e0\u6b64\uff0c\u5f00\u53d1\u8005\u9700\u8981\u5173\u6ce8\u7f16\u8bd1\u5668\u4e0e\u94fe\u63a5\u5668\u9009\u9879\uff0c\u5e76\u6839\u636e\u9879\u76ee\u5bf9\u4f18\u5316\u3001\u8b66\u544a\u4e0e\u9519\u8bef\u68c0\u51fa\u6c34\u5e73\u3001\u5b89\u5168\u52a0\u56fa\u7684\u9700\u8981\u6765\u7ba1\u7406\u5b83\u4eec\u3002\n\n\u8981\u786e\u5b9a\u4f60\u7cfb\u7edf\u4e0a GCC \u6216 Clang \u4f7f\u7528\u7684\u9ed8\u8ba4\u9009\u9879\uff0c\u53ef\u4ee5\u67e5\u770b\n```plaintext\ncc -v\n```\n_`<sourcefile.c>`_\n\u7684\u8f93\u51fa\uff0c\u5ba1\u89c6\u7f16\u8bd1\u5668\u6784\u5efa\u8be5\u6e90\u6587\u4ef6\u65f6\u4f7f\u7528\u7684\u5b8c\u6574\u547d\u4ee4\u884c\u3002\u8fd9\u4e9b\u4fe1\u606f\u6709\u4e24\u4e2a\u4e3b\u8981\u7528\u9014\uff1a\u4e86\u89e3\u7cfb\u7edf\u4e2d\u7f16\u8bd1\u5668\u7684\u914d\u7f6e\uff0c\u4ee5\u53ca\u6d1e\u6089\u53d1\u884c\u7248\u7ef4\u62a4\u8005\u6240\u9009\u7684\u9009\u9879\u3002\u6b64\u5916\uff0c\u5b83\u5728\u8bca\u65ad\u4e0e\u9009\u9879\u76f8\u5173\u7684\u95ee\u9898\u3001\u6392\u67e5\u8f6f\u4ef6\u7f16\u8bd1\u671f\u95f4\u53ef\u80fd\u51fa\u73b0\u7684\u95ee\u9898\u65f6\u4e5f\u5f88\u6709\u4ef7\u503c\u3002\u4f8b\u5982\u67d0\u4e9b\u9009\u9879\u4f9d\u8d56\u5176\u51fa\u73b0\u987a\u5e8f\uff1b\u5f53\u67d0\u4e2a\u53c2\u6570\u88ab\u8bbe\u7f6e\u591a\u6b21\u65f6\uff0c\u901a\u5e38\u540e\u51fa\u73b0\u8005\u751f\u6548\u3002\u901a\u8fc7\u5206\u6790\u6240\u7528\u7684\u5b8c\u6574\u9009\u9879\u5217\u8868\uff0c\u66f4\u5bb9\u6613\u6392\u67e5\u7531\u987a\u5e8f\u654f\u611f\u9009\u9879\u4e4b\u95f4\u76f8\u4e92\u4f5c\u7528\u5f15\u8d77\u7684\u95ee\u9898\u3002\n\n\u7c7b\u4f3c\u5730\uff0c\u8fd0\u884c\n```plaintext\ncc -O2 -dM -E - < /dev/null\n```\n\u4f1a\u4ea7\u51fa\u4e00\u4efd\u5b8f\u5b9a\u4e49\u5e38\u91cf\u7684\u5b8c\u6574\u6e05\u5355\u3002\u8fd9\u4efd\u8f93\u51fa\u53ef\u7528\u4e8e\u6392\u67e5\u4e0e\u901a\u8fc7\u7279\u5b9a\u5b8f\u5b9a\u4e49\u542f\u7528\u7684\u7f16\u8bd1\u5668\u6216\u5e93\u7279\u6027\u6709\u5173\u7684\u95ee\u9898\u3002\n\n\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u4ece\u7b2c\u4e09\u65b9\u5382\u5546\u83b7\u53d6 GCC \u53ef\u80fd\u5bfc\u81f4\u4f60\u7684 GCC \u5b9e\u4f8b\u88ab\u9884\u914d\u7f6e\u4e3a\u542f\u7528\u6216\u7981\u7528\u67d0\u4e9b\u9ed8\u8ba4\u9009\u9879\u3002\u8fd9\u4e9b\u9009\u9879\u4f1a\u663e\u8457\u5f71\u54cd\u7f16\u8bd1\u4ea7\u7269\u7684\u5b89\u5168\u6027\u3002\u56e0\u6b64\uff0c\u5982\u679c GCC \u6765\u81ea\u8f6f\u4ef6\u5305\u7ba1\u7406\u5668\u3001Linux \u53d1\u884c\u7248\u6216\u5176\u4ed6\u6e20\u9053\uff0c\u5ba1\u89c6\u9ed8\u8ba4\u9009\u9879\u5341\u5206\u5fc5\u8981\u3002\u6211\u4eec\u5efa\u8bae\u5728\u6784\u5efa\u811a\u672c\u6216\u6784\u5efa\u7cfb\u7edf\u914d\u7f6e\u4e2d\u663e\u5f0f\u542f\u7528\u6240\u9700\u7f16\u8bd1\u5668\u9009\u9879\uff0c\u800c\u4e0d\u662f\u4f9d\u8d56\u5de5\u5177\u94fe\u9ed8\u8ba4\u503c\u3002\u5982\u679c\u4f60\u5728\u4e3a Linux \u53d1\u884c\u7248\u5236\u4f5c\u8f6f\u4ef6\u5305\uff0c\u53d1\u884c\u7248\u7ef4\u62a4\u8005\u53ef\u80fd\u6709\u81ea\u5df1\u63a8\u8350\u7684\u5f15\u5165\u6784\u5efa\u9009\u9879\u7684\u65b9\u5f0f\u3002\u6b64\u7c7b\u60c5\u51b5\u4e0b\u8bf7\u53c2\u8003\u76f8\u5e94\u53d1\u884c\u7248\u6587\u6863\uff0c\u4f8b\u5982 Debian[19]\u3001Gentoo[20]\u3001Fedora[21]\u3001OpenSUSE[22] \u6216 Ubuntu[23]\u3002\n\n\u5178\u578b\u7684\u7f16\u8bd1\u5668\u914d\u7f6e\u4e0d\u4f1a\u62a5\u544a\u6765\u81ea\u7cfb\u7edf\u5934\u6587\u4ef6\u7684\u8b66\u544a\uff0c\u56e0\u4e3a\u5e94\u7528\u5f00\u53d1\u8005\u901a\u5e38\u65e0\u6cd5\u63a7\u5236\u8fd9\u4e9b\u5934\u6587\u4ef6\u3002\u5728 GCC \u4e2d\u8fd9\u662f\u56e0\u4e3a\n```plaintext\n-Wno-system-headers\n```\n\u9ed8\u8ba4\u5f00\u542f\uff0cclang \u901a\u5e38\u4e5f\u4f1a\u6291\u5236\u6765\u81ea\u7cfb\u7edf\u5934\u6587\u4ef6\u7684\u8b66\u544a[24]\u3002\u4f60\u5f88\u53ef\u80fd\u8fd8\u5e0c\u671b\u628a\u7b2c\u4e09\u65b9\u5305\u542b\u6587\u4ef6\u6807\u8bb0\u4e3a\u7cfb\u7edf\u5934\u6587\u4ef6\uff0c\u4ee5\u4fbf\u5927\u5e45\u63d0\u9ad8\u8b66\u544a\u7ea7\u522b\u3002\u7528\u547d\u4ee4\u884c\u9009\u9879`-isystem`\u6dfb\u52a0\u7684\u76ee\u5f55\u4f1a\u88ab GCC[25] \u4e0e Clang[26] \u89c6\u4e3a\u7cfb\u7edf\u5934\u6587\u4ef6\u76ee\u5f55\u3002\u5728 Cmake \u914d\u7f6e\u6587\u4ef6\u4e2d\uff0c\u53ef\u4ee5\u901a\u8fc7`include_directories`\u5728\u5176\u53c2\u6570\u524d\u52a0\u4e0a`SYSTEM`\u6765\u5b9e\u73b0[27]\u3002\u8fd9\u91cc\u6709\u53d6\u820d\u3002\u538b\u5236\u6765\u81ea\u7cfb\u7edf\u5934\u6587\u4ef6\u4e0e\u7b2c\u4e09\u65b9\u5e93\u7684\u8b66\u544a\uff0c\u53ef\u80fd\u63a9\u76d6\u5176\u4e2d\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u7684\u6f0f\u6d1e\u3002\u53e6\u4e00\u65b9\u9762\uff0c_\u4e0d_\u538b\u5236\u5b83\u4eec\u4f1a\u628a\u7cbe\u529b\u96c6\u4e2d\u5728\u5f00\u53d1\u8005\u901a\u5e38\u65e0\u6cd5\u63a7\u5236\u7684\u95ee\u9898\u4e0a\uff0c\u5728 CI \u4efb\u52a1\u4e2d\u4f7f\u7528\n```plaintext\n-Werror\n```\n\u65f6\u963b\u788d\u8fdb\u5c55\uff0c\u5e76\u4e14\u5e38\u5e38\u5bfc\u81f4\u96be\u4ee5\u652f\u6301\u7528\u65e7\u7248\u672c\u7b2c\u4e09\u65b9\u4ee3\u7801\u6784\u5efa\uff0c\u4f7f\u589e\u91cf\u5347\u7ea7\u53d8\u5f97\u56f0\u96be\u3002\n\n\u8868 1 \u4e2d\u7684\u9009\u9879\u6240\u542f\u7528\u7684\u7f16\u8bd1\u671f\u68c0\u67e5\u4e0d\u5f71\u54cd\u7f16\u8bd1\u5668\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u4ee3\u7801\uff0c\u56e0\u6b64\u4e0d\u4f1a\u5728\u6027\u80fd\u6216\u5176\u4ed6\u8fd0\u884c\u65f6\u7279\u6027\u4e0a\u5e26\u6765\u4efb\u4f55\u53d6\u820d\u3002\u5b83\u4eec\u53ea\u53d1\u51fa\u8b66\u544a\uff08\u82e5\u542f\u7528\u4e86\n```plaintext\n-Werror\n```\n\u5219\u53d1\u51fa\u9519\u8bef\uff09\uff0c\u544a\u77e5\u6e90\u7801\u4e2d\u53d1\u73b0\u7684\u6f5c\u5728\u7f3a\u9677\u3002\n\n\u542f\u7528\u8fd9\u7c7b\u989d\u5916\u8b66\u544a\u540e\uff0c\u5f00\u53d1\u8005\u5e94\u82b1\u65f6\u95f4\u7406\u89e3\u7f16\u8bd1\u5668\u6240\u6307\u51fa\u7684\u5e95\u5c42\u95ee\u9898\u5e76\u52a0\u4ee5\u89e3\u51b3\u3002\n\n\u8868 2 \u4e2d\u7684\u9009\u9879\u53ef\u5206\u4e3a\u4e24\u7c7b\uff1a\n\n1\u3001\u4f7f\u7f16\u8bd1\u5668\u4e3a\u4ea7\u51fa\u7684\u4e8c\u8fdb\u5236\u6dfb\u52a0\u8fd0\u884c\u65f6\u68c0\u67e5\u7684\u9009\u9879\uff0c\u8fd9\u4e9b\u68c0\u67e5\u65e8\u5728\u53d1\u73b0\u5185\u5b58\u9519\u8bef\uff1b2\u3001\u6307\u793a\u7f16\u8bd1\u5668\u8c03\u6574\u751f\u6210\u4e8c\u8fdb\u5236\u6216\u4ee3\u7801\u7684\u5c5e\u6027\uff0c\u4ee5\u786e\u4fdd\u4ea7\u51fa\u7684\u4e8c\u8fdb\u5236\u4e0e\u64cd\u4f5c\u7cfb\u7edf\u5f3a\u5236\u7684\u4fdd\u62a4\u673a\u5236\u517c\u5bb9\u7684\u9009\u9879\u3002\n\n\u6d4b\u8bd5\u5bf9\u4e8e\u9a8c\u8bc1\u8868 2 \u4e2d\u4efb\u4f55\u9009\u9879\u7684\u5f71\u54cd\u90fd\u81f3\u5173\u91cd\u8981\uff0c\u56e0\u4e3a\u5b83\u4eec\u4f1a\u5f71\u54cd\u7f16\u8bd1\u5668\u4ea7\u51fa\u7684\u4e8c\u8fdb\u5236\u3002\u4e0b\u6587\u63cf\u8ff0\u7684\u90e8\u5206\u7f16\u8bd1\u5668\u9009\u9879\u53ef\u80fd\u5f71\u54cd\u8f6f\u4ef6\u6027\u80fd\u3002\u4e0d\u8fc7\u8fd9\u79cd\u6027\u80fd\u5f71\u54cd\u901a\u5e38\u4e0e\u5177\u4f53\u573a\u666f\u76f8\u5173\uff0c\u591a\u6570\u60c5\u51b5\u4e0b\u8981\u4e48\u5f88\u5c0f\uff0c\u8981\u4e48\u6536\u76ca\u5927\u4e8e\u5f00\u9500\u3002\u5173\u4e8e\u4f55\u65f6\u53ef\u80fd\u51fa\u73b0\u663e\u8457\u6027\u80fd\u5f71\u54cd\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u53ef\u5728\u672c\u6587\u540e\u9762\u627e\u5230\u8fd9\u4e9b\u9009\u9879\u7684\u8be6\u7ec6\u63cf\u8ff0\u3002\n\n\u5bf9\u4e8e\u6027\u80fd\u662f\u5173\u952e\u56e0\u7d20\u7684\u8f6f\u4ef6\uff0c\u5f00\u53d1\u8005\u5e94\u7ed3\u5408\u5176\u8f6f\u4ef6\u7684\u5177\u4f53\u7528\u4f8b\uff0c\u4ed4\u7ec6\u8bc4\u4f30\u542f\u7528\u66f4\u591a\u5b89\u5168\u9009\u9879\u4e0e\u5b9e\u6d4b\u6027\u80fd\u6570\u636e\u4e4b\u95f4\u7684\u53d6\u820d\u3002\u5728\u751f\u4ea7\u73af\u5883\u5b9e\u65bd\u4efb\u4f55\u53d8\u66f4\u4e4b\u524d\uff0c\u5fc5\u987b\u8fdb\u884c\u5145\u5206\u7684\u57fa\u51c6\u6d4b\u8bd5\u4e0e\u6d4b\u8bd5\u3002\u8fd9\u5c06\u5e2e\u52a9\u4f60\u4e86\u89e3\u7f16\u8bd1\u5668\u9009\u9879\u5982\u4f55\u5f71\u54cd\u8f6f\u4ef6\u7684\u6027\u80fd\u4e0e\u5b89\u5168\u4e24\u65b9\u9762\u3002\u8bf7\u8bb0\u4f4f\uff0c\u4e00\u4e2a\u8fd0\u884c\u5f88\u5feb\u4f46\u5bf9\u5bf9\u624b\u4e0d\u582a\u4e00\u51fb\u7684\u7cfb\u7edf\uff0c\u5f88\u53ef\u80fd\u65e0\u6cd5\u88ab\u7528\u6237\u63a5\u53d7\u3002\u57fa\u51c6\u6d4b\u8bd5\u5e94\u8003\u8651\u76f8\u5173\u7684\u6027\u80fd\u7279\u5f81\uff0c\u4f8b\u5982\u5e73\u5747\u8017\u65f6\u3001\u6700\u574f\u60c5\u51b5\u8017\u65f6\u4ee5\u53ca\u6267\u884c\u671f\u95f4\u7684\u5185\u5b58\u5360\u7528\u3002\u6b64\u5916\uff0c\u4ea7\u51fa\u4e8c\u8fdb\u5236\u7684\u4f53\u79ef\u5f71\u54cd\u4e5f\u53ef\u80fd\u662f\u987e\u8651\uff0c\u5bf9\u5d4c\u5165\u5f0f\u7cfb\u7edf\u5c24\u5176\u5982\u6b64\u3002\n\n\u8868 1\uff1a\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u9009\u9879\uff0c\u542f\u7528\u4e25\u683c\u7684\u7f16\u8bd1\u671f\u68c0\u67e5\u3002\n\n- **`-Wall` `-Wextra`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u4e3a\u5e38\u4e0e\u7f3a\u9677\u76f8\u5173\u7684\u6784\u9020\u542f\u7528\u8b66\u544a\u3002\n- **`-Wformat` `-Wformat=2`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u989d\u5916\u7684\u683c\u5f0f\u5316\u51fd\u6570\u8b66\u544a\u3002\n- **`-Wconversion` `-Wsign-conversion`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u9690\u5f0f\u8f6c\u6362\u8b66\u544a\u3002\n- **`-Wtrampolines`** \u2014 GCC 4.3.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5173\u4e8e\u9700\u8981\u53ef\u6267\u884c\u6808\u7684 trampoline \u7684\u8b66\u544a\u3002\n- **`-Wimplicit-fallthrough`** \u2014 GCC 7.0.0\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u5f53 switch \u7684\u67d0\u4e2a case \u8d2f\u7a7f\u5230\u4e0b\u4e00\u4e2a case \u65f6\u53d1\u51fa\u8b66\u544a\u3002\n- **`-Wbidi-chars=any`** \u2014 GCC 12.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5173\u4e8e\u53ef\u80fd\u5177\u6709\u8bef\u5bfc\u6027\u7684 Unicode \u53cc\u5411\u63a7\u5236\u5b57\u7b26\u7684\u8b66\u544a\u3002\n- **`-Werror` `-Werror=` _`<warning-flag>`_** \u2014 GCC 2.95.3\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u628a\u6240\u6709\u6216\u9009\u5b9a\u7f16\u8bd1\u5668\u8b66\u544a\u5f53\u4f5c\u9519\u8bef\u3002\u4ec5\u5728\u5f00\u53d1\u671f\u95f4\u4f7f\u7528\u4e00\u63fd\u5b50\u5f62\u5f0f `-Werror`\uff0c\u4e0d\u8981\u5728\u6e90\u7801\u5206\u53d1\u4e2d\u4f7f\u7528\u3002\n- **`-Werror=format-security`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u628a\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u4e14\u4e0d\u5e26\u53c2\u6570\u4f7f\u7528\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u5f53\u4f5c\u9519\u8bef\u3002\n- **`-Werror=implicit` `-Werror=incompatible-pointer-types` `-Werror=int-conversion`** \u2014 GCC 2.95.3\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u628a\u8fc7\u65f6\u7684 C \u6784\u9020\u5f53\u4f5c\u9519\u8bef\u3002\n\n\u8868 2\uff1a\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u9009\u9879\uff0c\u542f\u7528\u8fd0\u884c\u65f6\u4fdd\u62a4\u673a\u5236\u3002\n\n- **`-D_FORTIFY_SOURCE=3`** \u2014 GCC 12.0.0\u3001Clang 9.0.0 \u8d77\u652f\u6301[2]\u3002\u4ee5\u7f16\u8bd1\u671f\u4e0e\u8fd0\u884c\u65f6\u68c0\u67e5\u52a0\u56fa\u6e90\u7801\uff0c\u9488\u5bf9\u4e0d\u5b89\u5168\u7684 libc \u7528\u6cd5\u4e0e\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u67d0\u4e9b\u52a0\u56fa\u7ea7\u522b\u4f1a\u5f71\u54cd\u6027\u80fd\u3002\u9700\u8981 `-O1` \u6216\u66f4\u9ad8\uff0c\u53ef\u80fd\u9700\u8981\u524d\u7f6e `-U_FORTIFY_SOURCE`\u3002\n- **`-D_GLIBCXX_ASSERTIONS`** \u2014 libstdc++ 6.0.0 \u8d77\u652f\u6301\u3002\u4e3a GNU C++ \u6807\u51c6\u5e93\u8c03\u7528\u63d0\u4f9b\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\u3002\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST`** \u2014 libc++ 18.1.0 \u8d77\u652f\u6301\u3002\u4e3a LLVM/Clang C++ \u6807\u51c6\u5e93\u8c03\u7528\u63d0\u4f9b\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\u3002\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-fstrict-flex-arrays=3`** \u2014 GCC 13.0.0\u3001Clang 16.0.0 \u8d77\u652f\u6301\u3002\u4ec5\u5f53\u7ed3\u6784\u4f53\u5c3e\u90e8\u6570\u7ec4\u58f0\u660e\u4e3a `[]` \u65f6\u624d\u5c06\u5176\u89c6\u4e3a\u67d4\u6027\u6570\u7ec4\u3002\n- **`-fstack-clash-protection`** \u2014 GCC 8.0.0\u3001Clang 11.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5bf9\u53ef\u53d8\u5927\u5c0f\u6808\u5206\u914d\u6709\u6548\u6027\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-fstack-protector-strong`** \u2014 GCC 4.9.0\u3001Clang 6.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5bf9\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-fcf-protection=full`** \u2014 GCC 8.0.0\u3001Clang 7.0.0 \u8d77\u652f\u6301\u3002\u5728 x86_64 \u4e0a\u542f\u7528\u9488\u5bf9\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff08ROP\uff09\u4e0e\u9762\u5411\u8df3\u8f6c\u7f16\u7a0b\uff08JOP\uff09\u653b\u51fb\u7684\u63a7\u5236\u6d41\u4fdd\u62a4\u3002\n- **`-mbranch-protection=standard`** \u2014 GCC 9.0.0\u3001Clang 8.0.0 \u8d77\u652f\u6301\u3002\u5728 AArch64 \u4e0a\u542f\u7528\u9488\u5bf9 ROP \u4e0e JOP \u653b\u51fb\u7684\u5206\u652f\u4fdd\u62a4\u3002\n- **`-fzero-call-used-regs=used-gpr`** \u2014 GCC 11.0.0\u3001Clang 16.0.0 \u8d77\u652f\u6301\u3002\u51fd\u6570\u8fd4\u56de\u65f6\u6e05\u96f6\u5176\u4f7f\u7528\u8fc7\u7684\u5bc4\u5b58\u5668\uff0c\u9650\u5236\u5bc4\u5b58\u5668\u6570\u636e\u7684\u751f\u547d\u5468\u671f\u4ee5\u53ca\u653b\u51fb\u8005\u53ef\u7528\u7684 ROP gadget\u3002\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-Wl,-z,nodlopen`** \u2014 Binutils 2.10.0 \u8d77\u652f\u6301\u3002\u9650\u5236 `dlopen(3)` \u8c03\u7528\u5bf9\u5171\u4eab\u5bf9\u8c61\u7684\u9002\u7528\u3002\n- **`-Wl,-z,noexecstack`** \u2014 Binutils 2.14.0 \u8d77\u652f\u6301\u3002\u901a\u8fc7\u628a\u6808\u5185\u5b58\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\u6765\u542f\u7528\u6570\u636e\u6267\u884c\u9632\u62a4\u3002\n- **`-Wl,-z,relro` `-Wl,-z,now`** \u2014 Binutils 2.15.0 \u8d77\u652f\u6301\u3002\u628a\u52a0\u8f7d\u65f6\u89e3\u6790\u7684\u91cd\u5b9a\u4f4d\u8868\u9879\u6807\u8bb0\u4e3a\u53ea\u8bfb\u3002`-Wl,-z,now` \u53ef\u80fd\u5f71\u54cd\u542f\u52a8\u6027\u80fd\u3002\n- **`-fPIE -pie`** \u2014 Binutils 2.16.0\u3001Clang 5.0.0 \u8d77\u652f\u6301\u3002\u6784\u5efa\u4e3a\u4f4d\u7f6e\u65e0\u5173\u53ef\u6267\u884c\u6587\u4ef6\u3002\u5728 32 \u4f4d\u67b6\u6784\u4e0a\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-fPIC -shared`** \u2014 \u65e9\u4e8e Binutils 2.6.0\u3001Clang 5.0.0 \u8d77\u652f\u6301\u3002\u6784\u5efa\u4e3a\u4f4d\u7f6e\u65e0\u5173\u4ee3\u7801\u3002\u5728 32 \u4f4d\u67b6\u6784\u4e0a\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-fno-delete-null-pointer-checks`** \u2014 GCC 3.0.0\u3001Clang 7.0.0 \u8d77\u652f\u6301\u3002\u5f3a\u5236\u4fdd\u7559\u7a7a\u6307\u9488\u68c0\u67e5\u3002\n- **`-fno-strict-overflow`** \u2014 GCC 4.2.0 \u8d77\u652f\u6301\u3002\u4e3a\u6709\u7b26\u53f7\u6574\u6570\u4e0e\u6307\u9488\u8fd0\u7b97\u6ea2\u51fa\u5b9a\u4e49\u884c\u4e3a\u3002\n- **`-fno-strict-aliasing`** \u2014 GCC 2.95.3\u3001Clang 2.9.0 \u8d77\u652f\u6301\u3002\u4e0d\u5047\u5b9a\u4e25\u683c\u522b\u540d\u3002\n- **`-ftrivial-auto-var-init`** \u2014 GCC 12.0.0\u3001Clang 8.0.0 \u8d77\u652f\u6301\u3002\u521d\u59cb\u5316\u7f3a\u5c11\u663e\u5f0f\u521d\u59cb\u5316\u5668\u7684\u81ea\u52a8\u53d8\u91cf\u3002\n- **`-fexceptions`** \u2014 GCC 2.95.3\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5f02\u5e38\u4f20\u64ad\u4ee5\u52a0\u56fa\u591a\u7ebf\u7a0b C \u4ee3\u7801\u3002\n- **`-fhardened`** \u2014 GCC 14.0.0 \u8d77\u652f\u6301\u3002\u5728 GCC \u4e2d\u542f\u7528\u4e00\u7ec4\u9884\u5148\u786e\u5b9a\u7684\u52a0\u56fa\u9009\u9879\u3002\n- **`-Wl,--as-needed` `-Wl,--no-copy-dt-needed-entries`** \u2014 Binutils 2.20.0 \u8d77\u652f\u6301\u3002\u5141\u8bb8\u94fe\u63a5\u5668\u7701\u7565\u547d\u4ee4\u884c\u4e2d\u6307\u5b9a\u7684\u3001\u5b9e\u9645\u672a\u88ab\u4f7f\u7528\u7684\u5e93\u3002\n- **`-fzero-init-padding-bits=all`** \u2014 GCC 15.0.0 \u8d77\u652f\u6301\u3002\u4fdd\u8bc1\u6240\u6709\u81ea\u52a8\u53d8\u91cf\u521d\u59cb\u5316\u5668\u4e2d\u7684\u586b\u5145\u4f4d\u88ab\u6e05\u96f6\u3002\n\n* * *\n\n### \u4e3a\u5e38\u4e0e\u7f3a\u9677\u76f8\u5173\u7684\u6784\u9020\u542f\u7528\u8b66\u544a\n\n- **`-Wall` `-Wextra`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u4e3a\u5e38\u4e0e\u7f3a\u9677\u76f8\u5173\u7684\u6784\u9020\u542f\u7528\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u8b66\u544a\u662f\u7f16\u8bd1\u671f\u8bca\u65ad\u6d88\u606f\uff0c\u6307\u51fa\u90a3\u4e9b\u867d\u975e\u5fc5\u7136\u9519\u8bef\u3001\u4f46\u6709\u98ce\u9669\u6216\u6697\u793a\u53ef\u80fd\u5199\u9519\u4e86\u7684\u7f16\u7a0b\u6784\u9020\u3002\n\n```plaintext\n-Wall\n```\n\u4e0e\n```plaintext\n-Wextra\n```\n\u7f16\u8bd1\u5668\u9009\u9879\u542f\u7528\u9884\u5b9a\u4e49\u7684\u7f16\u8bd1\u671f\u8b66\u544a\u96c6\u5408\u3002\n\n```plaintext\n-Wall\n```\n\u96c6\u5408\u4e2d\u7684\u8b66\u544a\u901a\u5e38\u5bb9\u6613\u907f\u514d\uff0c\u6216\u901a\u8fc7\u4fee\u6539\u6709\u95ee\u9898\u7684\u4ee3\u7801\u5c31\u80fd\u8f7b\u6613\u6d88\u9664\u3002\n\n```plaintext\n-Wextra\n```\n\u96c6\u5408\u4e2d\u7684\u8b66\u544a\u8981\u4e48\u662f\u60c5\u5883\u6027\u7684\uff0c\u8981\u4e48\u6307\u793a\u96be\u4ee5\u907f\u514d\u3001\u67d0\u4e9b\u60c5\u51b5\u4e0b\u53ef\u80fd\u786e\u6709\u5fc5\u8981\u7684\u95ee\u9898\u6784\u9020\u3002\n\n\u6ce8\u610f\uff1a\u5c3d\u7ba1\u540d\u5b57\u5982\u6b64\uff0c\n```plaintext\n-Wall\n```\n\u9009\u9879\u5e76**\u4e0d**\u542f\u7528\u6240\u6709\u53ef\u80fd\u7684\u8b66\u544a\u8bca\u65ad\uff0c\u800c\u53ea\u662f\u4e00\u4e2a\u9884\u5b9a\u4e49\u7684\u5b50\u96c6\u3002\u5173\u4e8e`-Wall`\u4e0e\n```plaintext\n-Wextra\n```\n\u6240\u542f\u7528\u7684\u5177\u4f53\u8b66\u544a\u5b8c\u6574\u6e05\u5355\uff0c\u8bf7\u5206\u522b\u67e5\u9605 GCC[28] \u4e0e Clang[29] \u6587\u6863\u3002\n\n* * *\n\n### \u542f\u7528\u989d\u5916\u7684\u683c\u5f0f\u5316\u51fd\u6570\u8b66\u544a\n\n- **`-Wformat`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u989d\u5916\u7684\u683c\u5f0f\u5316\u51fd\u6570\u8b66\u544a\u3002\n- **`-Wformat=2`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u989d\u5916\u7684\u683c\u5f0f\u5316\u51fd\u6570\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u68c0\u67e5\u5bf9\n```plaintext\nprintf\n```\n\u4e0e\n```plaintext\nscanf\n```\n\u7cfb\u5217\u51fd\u6570\u7684\u8c03\u7528\uff0c\u786e\u4fdd\u6240\u7ed9\u53c2\u6570\u7c7b\u578b\u4e0e\u6307\u5b9a\u683c\u5f0f\u5b57\u7b26\u4e32\u76f8\u79f0\uff0c\u4e14\u683c\u5f0f\u5b57\u7b26\u4e32\u4e2d\u6307\u5b9a\u7684\u8f6c\u6362\u5408\u7406\u3002\n\n\u5728 GCC \u4e2d\uff0c\n```plaintext\n-Wformat=2\n```\n\u5f62\u5f0f\u8fd8\u4f1a\u542f\u7528\u67d0\u4e9b\u989d\u5916\u68c0\u67e5\uff0c\u5305\u62ec\uff1a\n\n- \u82e5\u683c\u5f0f\u5b57\u7b26\u4e32\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u56e0\u800c\u65e0\u6cd5\u68c0\u67e5\uff0c\u5219\u53d1\u51fa\u8b66\u544a\uff0c\u9664\u975e\u8be5\u683c\u5f0f\u5316\u51fd\u6570\u628a\u5176\u683c\u5f0f\u53c2\u6570\u4f5c\u4e3a va_list \u63a5\u6536\uff08\n```plaintext\n-Wformat-nonliteral\n```\n\uff09\u3002\n- \u5bf9\u8868\u793a\u53ef\u80fd\u5b89\u5168\u95ee\u9898\u7684\u683c\u5f0f\u5316\u51fd\u6570\u7528\u6cd5\u53d1\u51fa\u8b66\u544a\uff08\n```plaintext\n-Wformat-security\n```\n\uff09\u3002\n- \u5bf9\u53ef\u80fd\u53ea\u4ea7\u51fa\u4e24\u4f4d\u5e74\u4efd\u7684\n```plaintext\nstrftime\n```\n\u683c\u5f0f\u53d1\u51fa\u8b66\u544a\uff08\n```plaintext\n-Wformat-y2k\n```\n\uff09\u3002\n\n\u5728 Clang \u4e2d\uff0c\n```plaintext\n-Wformat\n```\n\u5305\u542b\u4e0e`-Wformat=2`\u76f8\u540c\u7684\u8bca\u65ad\uff0c\u4f46\u4e0e GCC \u4e0d\u540c\uff0cClang \u4e2d\u7684`-Wformat=2`\u5e76\u4e0d\u5305\u542b`-Wformat`\u7684\u8bca\u65ad\u3002\u9274\u4e8e\u8fd9\u79cd\u5dee\u5f02\uff0c\u6211\u4eec\u5efa\u8bae\u5728\u53ef\u80fd\u540c\u65f6\u7528 GCC \u4e0e Clang \u6784\u5efa\u7684\u9879\u76ee\u4e2d\u540c\u65f6\u6307\u5b9a`-Wformat`\u4e0e\n```plaintext\n-Wformat=2\n```\n\u3002\n\n* * *\n\n### \u542f\u7528\u9690\u5f0f\u8f6c\u6362\u8b66\u544a\n\n- **`-Wconversion` `-Wsign-conversion`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u9690\u5f0f\u8f6c\u6362\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u68c0\u67e5\u53ef\u80fd\u6539\u53d8\u503c\u7684\u9690\u5f0f\u8f6c\u6362\uff0c\u4f8b\u5982\uff1a\n\n- \u5b9e\u6570\u4e0e\u6574\u6570\u6570\u636e\u7c7b\u578b\u4e4b\u95f4\u7684\u8f6c\u6362\n- \u6709\u7b26\u53f7\u4e0e\u65e0\u7b26\u53f7\u6570\u636e\u7c7b\u578b\u4e4b\u95f4\u7684\u8f6c\u6362\n- \u4e0d\u540c\u5927\u5c0f\u6570\u636e\u7c7b\u578b\u4e4b\u95f4\u7684\u8f6c\u6362\n- C++ \u4e2d\u7528\u6237\u5b9a\u4e49\u8f6c\u6362\u7684\u91cd\u8f7d\u51b3\u8bae\u88ab\u6df7\u6dc6\n- C++ \u4e2d\u4ece\u4e0d\u4f7f\u7528\u7c7b\u578b\u8f6c\u6362\u8fd0\u7b97\u7b26\u7684\u8f6c\u6362\uff1a\u8f6c\u6362\u4e3a void\u3001\u8f6c\u6362\u4e3a\u540c\u4e00\u7c7b\u578b\u3001\u8f6c\u6362\u4e3a\u57fa\u7c7b\u6216\u5f15\u7528\u3002\n\n\u5bfc\u81f4\u6570\u636e\u503c\u88ab\u6539\u53d8\u7684\u8f6c\u6362\uff0c\u53ef\u80fd\u4f7f\u4fe1\u606f\u88ab\u4e22\u5f03\u6216\u4ee5\u4ea7\u751f\u610f\u5916\u503c\u7684\u65b9\u5f0f\u88ab\u8f6c\u6362\u3002\n\n\u5982\u679c\u7ed3\u679c\u503c\u88ab\u7528\u5728\u63a7\u5236\u5185\u5b58\u8bbf\u95ee\u6216\u5b89\u5168\u51b3\u7b56\u7684\u8bed\u5883\u4e2d\uff0c\u5c31\u53ef\u80fd\u51fa\u73b0\u5371\u9669\u884c\u4e3a\uff0c\u4f8b\u5982\u6574\u6570\u7b26\u53f7\u6027\u6216\u622a\u65ad\u9519\u8bef\u53ef\u80fd\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\n\n\u5bf9\u4e8e C++\uff0c\u5173\u4e8e\u6709\u7b26\u53f7\u4e0e\u65e0\u7b26\u53f7\u6574\u6570\u4e4b\u95f4\u8f6c\u6362\u7684\u8b66\u544a\u9ed8\u8ba4\u5173\u95ed\uff0c\u9664\u975e\u663e\u5f0f\u542f\u7528\n```plaintext\n-Wsign-conversion\n```\n\u3002\n\n\u6b64\u8b66\u544a\u53ea\u9002\u7528\u4e8e\u53ef\u80fd\u5bfc\u81f4\u6570\u636e\u4e22\u5931\u7684\u6570\u636e\u8f6c\u6362\u3002C \u4e0e C++ \u7684\u6761\u4ef6\u8868\u8fbe\u5f0f\uff08\u4f8b\u5982 if \u8bed\u53e5\u4e4b\u540e\uff09\u63a5\u53d7\u5e03\u5c14\u4ee5\u5916\u7684\u7c7b\u578b\uff0c\u4f8b\u5982\u6574\u6570\uff08\u975e\u96f6\u88ab\u89e3\u91ca\u4e3a\u771f\uff09\u4e0e\u6307\u9488\uff08\u975e NULL \u88ab\u89e3\u91ca\u4e3a\u771f\uff09\u3002\u8fd9\u79cd\u771f\u503c\u89e3\u91ca\u5728\u67d0\u79cd\u610f\u4e49\u4e0a\u53ef\u7b97\u4f5c\u6570\u636e\u7c7b\u578b\u8f6c\u6362\uff0c\u4f46\u6b64\u9009\u9879\u4e0d\u4f1a\u5bf9\u8fd9\u4e9b\u5b8c\u5168\u5408\u7406\u7684\u6784\u9020\u4ea7\u751f\u865a\u5047\u8b66\u544a\u3002\n\n### \u989d\u5916\u8003\u91cf\n\n\u5728\u5927\u578b\u68d5\u5730\u4ee3\u7801\u5e93\u4e0a\uff0c\n```plaintext\n-Wconversion\n```\n\u9009\u9879\u53ef\u80fd\u4ea7\u751f\u6210\u767e\u4e0a\u5343\u6761\u8b66\u544a\uff0c\u5176\u4e2d\u8bb8\u591a\u662f\u826f\u6027\u7684\uff0c\u6216\u6e90\u81ea\u60ef\u7528\u7684 C \u6a21\u5f0f\u3002GCC wiki \u6307\u51fa`-Wconversion`_\u201c\u9762\u5411\u5c0f\u4f17\u7528\u9014\u2026\u2026\u5373\u7a0b\u5e8f\u5458\u613f\u610f\u63a5\u53d7\u5e76\u7ed5\u8fc7\u65e0\u6548\u8b66\u544a\u7684\u573a\u666f\u3002\u201d_[30] \u7531\u4e8e\u8bca\u65ad\u91cf\u5de8\u5927\uff0c\u5f00\u53d1\u8005\u53ef\u80fd\u5f00\u59cb\u5ffd\u7565\u6240\u6709\u8b66\u544a\uff0c\u4ece\u800c\u4f7f\u8be5\u9009\u9879\u5931\u53bb\u610f\u4e49\u3002\u5bf9\u8fd9\u7c7b\u9879\u76ee\uff0c\u66f4\u52a1\u5b9e\u7684\u505a\u6cd5\u662f\u4ece\u8303\u56f4\u66f4\u7a84\u7684`-Wsign-conversion`\u5f00\u59cb\uff0c\u6216\u53ea\u5bf9\u9009\u5b9a\u7684\u7ffb\u8bd1\u5355\u5143\u542f\u7528\n```plaintext\n-Wconversion\n```\n\u3002\n\n\u56e0\u6b64\u6211\u4eec\u5efa\u8bae\u7eff\u5730\u9879\u76ee\uff08\u65b0\u4ee3\u7801\uff09\u4ece\u7b2c\u4e00\u5929\u5c31\u542f\u7528\n```plaintext\n-Wconversion\n```\n\u5e76\u4fdd\u6301\u6784\u5efa\u65e0\u8b66\u544a\u3002\u628a\u8be5\u9009\u9879\u52a0\u5165\u6301\u7eed\u96c6\u6210\uff08CI\uff09\u68c0\u67e5\uff0c\u4f7f\u65b0\u8865\u4e01\u65e0\u6cd5\u91cd\u65b0\u5f15\u5165\u8f6c\u6362\u3002\n\n\u5bf9\u68d5\u5730\u9879\u76ee\uff08\u65e2\u6709\u4ee3\u7801\uff09\uff0c\u6211\u4eec\u5efa\u8bae\u5206\u9636\u6bb5\u63a8\u8fdb\uff1a\n\n1\u3001\u5148\u7528\n```plaintext\n-Wconversion\n```\n\u6784\u5efa\u4e00\u6b21\u4f46\u4e0d\u8ba9\u6784\u5efa\u5931\u8d25\uff08\u7701\u7565\n```plaintext\n-Werror\n```\n\uff09\uff0c\u8bb0\u5f55\u57fa\u7ebf\u3002\n2\u3001\u7528\n```plaintext\n#pragma GCC diagnostic ignored \"-Wconversion\"\n```\n\u6216\u9488\u5bf9\u6027\u7684\n```plaintext\n-Wno-conversion\n```\n\u9009\u9879\u6291\u5236\u5df2\u77e5\u826f\u6027\u7684\u6a21\u5f0f\u3002\n3\u3001\u5206\u8bca\u5269\u4f59\u8b66\u544a\uff0c\u4f18\u5148\u5904\u7406\u9ad8\u98ce\u9669\u8005\uff08\u5f71\u54cd\u6570\u7ec4\u7d22\u5f15\u3001\u5bf9\u8c61\u5927\u5c0f\u8ba1\u7b97\u6216\u5b89\u5168\u654f\u611f\u903b\u8f91\u7684\u8f6c\u6362\uff09\uff0c\u91cd\u6784\u5b83\u4eec\u6216\u628a\u5f3a\u5236\u8f6c\u6362\u5199\u6210\u663e\u5f0f\u3002\n4\u3001\u9010\u6b65\u6536\u7d27\u8be5\u9009\u9879\uff1a\u8b66\u544a \u2192 \u9519\u8bef \u2192 \u7eb3\u5165 CI\u3002\n\n### \u79fb\u9664\u9690\u5f0f\u5f3a\u5236\u8f6c\u6362\n\n\u5728\u5b9e\u9645\u53ef\u884c\u65f6\uff0c\u5bfc\u81f4\u6570\u636e\u4e22\u5931\u7684\u9690\u5f0f\u5f3a\u5236\u8f6c\u6362\u5e94\u88ab\u91cd\u6784\u6389\uff0c\u4f7f\u5176\u4e0d\u518d\u5fc5\u8981\u3002\u4f8b\u5982\u53ef\u4ee5\uff1a\n\n- \u901a\u8fc7\u7edf\u4e00\u7c7b\u578b\u6765\u6d88\u9664\n- \u91cd\u5199\u4ee5\u6e05\u6670\u53cd\u6620\u7a0b\u5e8f\u5458\u610f\u56fe\uff08\u4f8b\u5982\u5bf9\u503c\u505a\u94b3\u5236\u800c\u4e0d\u662f\u622a\u65ad\u6bd4\u7279\uff09\u3002\n\n\u5982\u679c\u8fd9\u79cd\u5f3a\u5236\u8f6c\u6362\u786e\u6709\u5fc5\u8981\uff0c\u5c31\u628a\u5b83\u4ece\u9690\u5f0f\u8f6c\u6362\u6539\u4e3a\u663e\u5f0f\u8f6c\u6362\u3002\u6bcf\u4e00\u5904\u8fd9\u6837\u7684\u8f6c\u6362\u90fd\u5e94\u6709\u6ce8\u91ca\u8bf4\u660e\u7406\u7531\u3002\u7528\u663e\u5f0f C \u98ce\u683c\u5f3a\u5236\u8f6c\u6362\u66ff\u4ee3\u9690\u5f0f\u8f6c\u6362\u7684\u4e00\u4e2a\u95ee\u9898\u662f\uff0c\u7528\u9519\u65f6\u4f1a\u5f15\u5165\u65b0 bug\u3002\u4f8b\u5982\uff0c\u82e5\u672c\u5e94\u4ece 32 \u4f4d\u503c\u9690\u5f0f\u8f6c\u6362\u5230 16 \u4f4d short\uff0c\u5374\u88ab\u8bef\u6539\u4e3a\u8f6c\u6362\u5230 8 \u4f4d char\uff0c\u5c31\u4f1a\u622a\u65ad\u66f4\u591a\u6bd4\u7279\u5e76\u6b6a\u66f2\u610f\u56fe\u3002\n\n### \u6765\u81ea\u7b2c\u4e09\u65b9\u5934\u6587\u4ef6\u7684\u8b66\u544a\u566a\u58f0\n\n\u8b66\u544a\u53ef\u80fd\u6765\u81ea\u7cfb\u7edf\u6216\u7b2c\u4e09\u65b9\u5934\u6587\u4ef6\uff08\u4f8b\u5982\n```plaintext\n/usr/include\n```\n\u4e0b\u7684 Linux \u5934\u6587\u4ef6\uff09\u3002\u8fd9\u4e9b\u8b66\u544a\u4e0d\u5e94\u59a8\u788d\u5bf9\u81ea\u5df1\u4ee3\u7801\u7684\u5206\u6790\u3002\u6b64\u7c7b\u60c5\u51b5\u4e0b\uff0c\u53ef\u4ee5\u7528\u8bca\u65ad pragma \u5305\u4f4f include[31]\uff1a\n\n```C\n/*\n * Disable -Wconversion warnings caused by host headers\n */\n#pragma GCC diagnostic push\n#pragma GCC diagnostic ignored \"-Wconversion\"\n\n#include \n#include \n...\n\n#pragma GCC diagnostic pop  /* restore -Wconversion warnings */\n```\n\n* * *\n\n### \u542f\u7528\u5173\u4e8e\u9700\u8981\u53ef\u6267\u884c\u6808\u7684 trampoline \u7684\u8b66\u544a\n\n- **`-Wtrampolines`** \u2014 GCC 4.3.0 \u8d77\u652f\u6301\u3002\u542f\u7528\u5173\u4e8e\u9700\u8981\u53ef\u6267\u884c\u6808\u7684 trampoline \u7684\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u68c0\u67e5\u7f16\u8bd1\u5668\u662f\u5426\u4e3a\u6307\u5411\u5d4c\u5957\u51fd\u6570\u7684\u6307\u9488[32]\uff08GNU C \u5bf9 ISO \u6807\u51c6 C \u7684\u6269\u5c55\uff09\u751f\u6210 trampoline\uff0c\u800c\u6808\u865a\u62df\u5185\u5b58\u4fdd\u62a4\uff08\u4e0d\u53ef\u6267\u884c\u6808\uff09\u53ef\u80fd\u4e0e\u4e4b\u51b2\u7a81\u3002\n\ntrampoline \u662f\u4e00\u5c0f\u6bb5\u6570\u636e\u6216\u4ee3\u7801\uff0c\u5728\u53d6\u5d4c\u5957\u51fd\u6570\u5730\u5740\u65f6\u4e8e\u6808\u4e0a\u8fd0\u884c\u65f6\u521b\u5efa\uff0c\u7528\u4e8e\u95f4\u63a5\u8c03\u7528\u8be5\u5d4c\u5957\u51fd\u6570\u3002\n\n\u5bf9\u5927\u591a\u6570\u76ee\u6807\u67b6\u6784\uff08\u5305\u62ec 64 \u4f4d x86\uff09\uff0ctrampoline \u7531\u4ee3\u7801\u6784\u6210\uff0c\u56e0\u6b64\u9700\u8981\u628a\u6808\u8bbe\u4e3a\u53ef\u6267\u884c\uff0c\u7a0b\u5e8f\u624d\u80fd\u6b63\u5e38\u5de5\u4f5c\u3002\u6240\u6709\u4e3b\u6d41\u64cd\u4f5c\u7cfb\u7edf\u7528\u6765\u9632\u6b62\u4ee3\u7801\u6ce8\u5165\u653b\u51fb\u7684\u4e0d\u53ef\u6267\u884c\u6808\u7f13\u89e3\u63aa\u65bd\uff08\u53c2\u89c1`-Wl,-z,noexecstack`\uff09\uff0c\u53ef\u80fd\u5e72\u6270\u8fd9\u7c7b trampoline \u7684\u8fd0\u884c\uff0c\u4f7f\u4e0d\u517c\u5bb9\u7684\u7a0b\u5e8f\u5728\u628a\u63a7\u5236\u6d41\u8f6c\u79fb\u5230\u4e0d\u53ef\u6267\u884c\u6808\u4e0a\u7684 trampoline \u65f6\u5d29\u6e83\u3002\n\n\u542f\u7528\n```plaintext\n-Wtrampolines\n```\n\u4f1a\u5bf9\u4e0e\u4e0d\u53ef\u6267\u884c\u6808\u7f13\u89e3\u63aa\u65bd\u4e0d\u517c\u5bb9\u7684\u7f16\u7a0b\u6784\u9020\u53d1\u51fa\u8b66\u544a\u3002\n\n* * *\n\n### \u5bf9 switch \u8bed\u53e5\u4e2d\u7684\u9690\u5f0f\u8d2f\u7a7f\u53d1\u51fa\u8b66\u544a\n\n- **`-Wimplicit-fallthrough`** \u2014 GCC 7.0.0\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u5f53 switch \u7684\u67d0\u4e2a case \u8d2f\u7a7f\u5230\u4e0b\u4e00\u4e2a case \u65f6\u53d1\u51fa\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u5f53 switch \u8bed\u53e5\u4e2d\u51fa\u73b0\u672a\u88ab\u660e\u786e\u6807\u8bb0\u4e3a\u6709\u610f\u4e3a\u4e4b\u7684\u9690\u5f0f\u8d2f\u7a7f\u65f6\u53d1\u51fa\u8b66\u544a\u3002\n\nC \u4e0e C++ \u4e2d\u7684\n```plaintext\nswitch\n```\n\u8bed\u53e5\u5141\u8bb8\u4e00\u4e2a case \u5757\u8d2f\u7a7f\u5230\u4e0b\u4e00\u4e2a case \u5757\uff08\u9664\u975e\u524d\u9762\u6709 break\u3001return\u3001goto \u4e4b\u7c7b\uff09\u3002\u8fd9\u5728 C \u4e2d\u88ab\u5e7f\u6cdb\u89c6\u4e3a\u8bbe\u8ba1\u7f3a\u9677\uff0c\u56e0\u4e3a\u5e38\u89c1\u9519\u8bef\u5c31\u662f\u5728_\u5e76\u4e0d_\u5e0c\u671b\u8d2f\u7a7f\u65f6\u53d1\u751f\u4e86\u8d2f\u7a7f[33]\u3002\n\n\u8be5\u8b66\u544a\u9009\u9879\u4f1a\u5728\u53d1\u751f\u8d2f\u7a7f\u65f6\u53d1\u51fa\u8b66\u544a\uff0c\u9664\u975e\u5b83\u88ab\u7279\u522b\u6807\u8bb0\u4e3a_\u6709\u610f\u4e3a\u4e4b_\u3002Linux \u5185\u6838\u9879\u76ee\u4f7f\u7528\u4e86\u8be5\u9009\u9879\uff1b\u5b83\u4fc3\u6210\u4e86\u8bb8\u591a bug \u7684\u53d1\u73b0\u4e0e\u4fee\u590d[34]\u3002\n\n\u8be5\u8b66\u544a\u9009\u9879\u6ca1\u6709\u6027\u80fd\u5f71\u54cd\u3002\u4e0d\u8fc7\uff0c\u6709\u65f6\u8d2f\u7a7f_\u786e\u5b9e_\u662f\u6709\u610f\u7684\u3002\u8be5\u9009\u9879\u8981\u6c42\u5f00\u53d1\u8005\u5728\u6e90\u7801\u4e2d\u4e3a\u8fd9\u4e9b\uff08\u5c11\u89c1\u7684\uff09\u6709\u610f\u8d2f\u7a7f\u60c5\u5f62\u52a0\u6ce8\u89e3\uff0c\u4ee5\u6291\u5236\u8b66\u544a\u3002\u663e\u7136\uff0c\u8be5\u6ce8\u89e3\u5e94_\u53ea_\u7528\u4e8e\u786e\u5b9e\u6709\u610f\u4e3a\u4e4b\u7684\u60c5\u5f62\u3002C++17\uff08\u6216\u66f4\u65b0\uff09\u4ee3\u7801\u5e94\u76f4\u63a5\u4f7f\u7528\n```plaintext\n[[fallthrough]]\n```\n\u5c5e\u6027\uff0c\u56e0\u4e3a\u5b83\u662f\u6807\u51c6\u505a\u6cd5\uff08\u8bb0\u5f97\u5728\u5176\u540e\u52a0\n```plaintext\n;\n```\n\uff09\u3002\n\nC17 \u6807\u51c6[35]\u6ca1\u6709\u63d0\u4f9b\u6807\u8bb0\u6709\u610f\u8d2f\u7a7f\u7684\u673a\u5236\u3002\u4e0d\u540c\u5de5\u5177\u652f\u6301\u4e0d\u540c\u7684\u6807\u8bb0\u673a\u5236\uff0c\u5305\u62ec\u5404\u79cd\u5f62\u5f0f\u7684\u5c5e\u6027\u4e0e\u6ce8\u91ca[36]\u3002\u4e00\u79cd\u53ef\u79fb\u690d\u7684\u6807\u8bb0\u65b9\u5f0f\u662f\u5b9a\u4e49\u4e00\u4e2a\u540d\u4e3a\n```plaintext\nfallthrough()\n```\n\u7684\u7c7b\u51fd\u6570\u5b8f\uff0c\u7528\u6765\u6807\u8bb0\u6709\u610f\u8d2f\u7a7f\uff0c\u5e76\u9002\u914d\u76f8\u5173\u5de5\u5177\uff08\u5982\u7f16\u8bd1\u5668\uff09\u7684\u673a\u5236\u3002\u6211\u4eec\u5efa\u8bae\u4f7f\u7528\u4e0b\u9762\u8fd9\u4e2a\u6784\u9020\uff0c\u5176\u7075\u611f\u6765\u81ea Linux \u5185\u6838 6.4 \u53ca\u4e4b\u540e\u7248\u672c\u6240\u7528\u7684\u7c7b\u5173\u952e\u5b57\u6784\u9020[37]\u3002\u6211\u4eec\u5efa\u8bae\u6539\u7528\u51fd\u6570\u8c03\u7528\u8bed\u6cd5\uff0c\u4ee5\u4fbf\u66f4\u591a\u7f16\u8f91\u5668\u4e0e\u5176\u4ed6\u5de5\u5177\u6b63\u786e\u5904\u7406\u5b83\uff1a\n\n```\n#ifdef __has_attribute\n# if __has_attribute(__fallthrough__)\n#  define fallthrough()                    __attribute__((__fallthrough__))\n# endif\n#endif\n#ifndef fallthrough\n# define fallthrough()                    do {} while (0)  /* fallthrough */\n#endif\n```\n\n```plaintext\n__fallthrough__\n```\n\u5c5e\u6027\u81ea GCC 7.0.0[38] \u4e0e Clang 4.0.0[39] \u8d77\u53d7\u652f\u6301\u3002\u901a\u8fc7\n```plaintext\n__has_attribute\n```\n\u505a\u7279\u6027\u6d4b\u8bd5\u81ea GCC 5.0.0[40] \u4e0e Clang 2.9 \u8d77\u53d7\u652f\u6301\u3002\n\n* * *\n\n### \u542f\u7528\u5173\u4e8e\u53ef\u80fd\u5177\u6709\u8bef\u5bfc\u6027\u7684 Unicode \u53cc\u5411\u63a7\u5236\u5b57\u7b26\u7684\u8b66\u544a\n\n- **`-Wbidi-chars=any`** \u2014 GCC 12.0.0 \u8d77\u652f\u6301\u3002\u5bf9\u6ce8\u91ca\u3001\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u7684\u4efb\u4f55 UTF-8 \u53cc\u5411\u63a7\u5236\u5b57\u7b26\u542f\u7528\u8b66\u544a\u3002\n- **`-Wbidi-chars=any,ucn`** \u2014 GCC 12.0.0 \u8d77\u652f\u6301\u3002\u540c `any`\uff0c\u5e76\u989d\u5916\u5bf9\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u5bf9\u5e94\u53cc\u5411\u63a7\u5236\u5b57\u7b26\u7684 UCN \u53d1\u51fa\u8b66\u544a\u3002\n- **`-Wbidi-chars=unpaired`** \u2014 GCC 12.0.0 \u8d77\u652f\u6301\u3002\u5bf9\u6ce8\u91ca\u3001\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u672a\u6210\u5bf9\u7684 UTF-8 \u53cc\u5411\u63a7\u5236\u5b57\u7b26\u542f\u7528\u8b66\u544a\u3002\n- **`-Wbidi-chars=unpaired,ucn`** \u2014 GCC 12.0.0 \u8d77\u652f\u6301\u3002\u540c `unpaired`\uff0c\u5e76\u989d\u5916\u5bf9\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u5bf9\u5e94\u672a\u6210\u5bf9\u53cc\u5411\u63a7\u5236\u5b57\u7b26\u7684 UCN \u53d1\u51fa\u8b66\u544a\u3002\n\n### \u6982\u8981\n\n\u68c0\u67e5\u6ce8\u91ca\u3001\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u53ef\u80fd\u5177\u6709\u8bef\u5bfc\u6027\u7684 Unicode \u53cc\u5411\uff08bidi\uff09\u63a7\u5236\u5b57\u7b26\u3002\n\n\u6709\u4e9b\u4e66\u5199\u7cfb\u7edf\uff08\u5982\u963f\u62c9\u4f2f\u8bed\u3001\u5e0c\u4f2f\u6765\u8bed\u3001\u6ce2\u65af\u8bed\u4e0e\u4e4c\u5c14\u90fd\u8bed\uff09\u901a\u5e38\u4ece\u53f3\u5230\u5de6\uff08RTL\uff09\u4e66\u5199\uff0c\u800c\u8bb8\u591a\u5176\u4ed6\u7cfb\u7edf\uff08\u5982\u82f1\u8bed\uff09\u4ece\u5de6\u5230\u53f3\uff08LTR\uff09\u4e66\u5199\u3002\u6709\u4e9b\u6587\u6863\u5fc5\u987b\u6df7\u7528\u4e0d\u540c\u65b9\u5411\u7684\u4e66\u5199\u7cfb\u7edf\uff0c\u4f8b\u5982\u6e90\u7801\u4e2d\u5e26\u6709\u4ece\u53f3\u5230\u5de6\u4e66\u5199\u7684\u6ce8\u91ca\u3002Unicode \u652f\u6301\u5404\u79cd\u63a7\u5236\u5e8f\u5217\u6765\u5b9e\u73b0\u8fd9\u79cd\u89c6\u89c9\u91cd\u6392\u3002\u4e0d\u5e78\u7684\u662f\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8fd9\u7c7b\u63a7\u5236\u5e8f\u5217\u6df7\u6dc6\u6e90\u7801\uff0c\u4ece\u800c\u5411\u4eba\u5de5\u8bc4\u5ba1\u8005\u9690\u85cf\u6f0f\u6d1e\u3002\u7ec6\u81f4\u7684\u4eba\u5de5\u8bc4\u5ba1\u901a\u5e38\u662f\u68c0\u6d4b\u6076\u610f\u4ee3\u7801\u6700\u6709\u529b\u7684\u624b\u6bb5\u4e4b\u4e00\u3002\u4e0d\u5e78\u7684\u662f\uff0c\u6076\u610f\u8bef\u5bfc\u6027\u4ee3\u7801\uff0c\u5373_\u201c\u9634\u624b\u4ee3\u7801\u201d_\uff0c\u6b63\u662f\u8bd5\u56fe\u98a0\u8986\u4eba\u5de5\u8bc4\u5ba1[16]\u3002_\u201c\u6728\u9a6c\u6e90\u7801\u201d_\uff08Trojan Source\uff09[17]\u662f\u9634\u624b\u4ee3\u7801\u7684\u4e00\u79cd\u7279\u5b9a\u7c7b\u578b\uff0c\u5b83\u5229\u7528 Unicode \u53cc\u5411\u7b97\u6cd5\u2014\u2014\u8be5\u7b97\u6cd5\u5728\u663e\u793a\u53cc\u5411\u6587\u672c\u65f6\u4ea7\u751f\u6b63\u786e\u7684\u5b57\u7b26\u987a\u5e8f\u3002\n\nGCC \u7684\n```plaintext\n-Wbidi-chars\n```\n\u9009\u9879\u6709\u52a9\u4e8e\u62b5\u5fa1\u6728\u9a6c\u6e90\u7801\u653b\u51fb[41]\u3002\u5176\u9ed8\u8ba4\u503c\u4e3a\n```plaintext\n-Wbidi-chars=unpaired\n```\n\uff0c\u4f1a\u5bf9\u672a\u6b63\u786e\u7ec8\u6b62\u7684\u53cc\u5411\u4e0a\u4e0b\u6587\u53d1\u51fa\u8b66\u544a\uff08\u8fd9\u5728\u6e90\u7801\u4e2d\u672c\u4e0d\u8be5\u53d1\u751f\uff09\u3002\u7136\u800c\u8fd9\u4e2a\u9ed8\u8ba4\u503c\u6709\u4e9b\u5bbd\u677e\u3002\n\n\u5728\u8bb8\u591a\u60c5\u51b5\u4e0b\uff0c\u4f7f\u7528\n```plaintext\n-Wbidi-chars=any\n```\n\u662f\u66f4\u5f3a\u7684\u9632\u5fa1\u3002\u8be5\u9009\u9879\u7981\u6b62\u5728\u6ce8\u91ca\u3001\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d_\u4efb\u4f55_\u4f7f\u7528\u53cc\u5411\u63a7\u5236\u5b57\u7b26\uff0c\u4ece\u800c\u5f7b\u5e95\u6d88\u9664\u6728\u9a6c\u6e90\u7801\u653b\u51fb\u3002\u5f53\u6e90\u7801\u4e2d_\u4e0d_\u9884\u671f\u51fa\u73b0\u53cc\u5411\u5b57\u7b26\u3001\u5176\u552f\u4e00\u7528\u9014\u53ea\u4f1a\u662f\u5bf9\u8bc4\u5ba1\u8005\u7684\u653b\u51fb\u65f6\uff0c\u8fd9\u4e2a\u8bbe\u7f6e\u662f\u5408\u9002\u7684\u3002\n\n```plaintext\n-Wbidi-chars=any\n```\n\u4e0e`-Wbidi-chars=unpaired`\u90fd\u53ef\u4e0e`ucn`\u53c2\u6570\u7ec4\u5408\uff0c\u8be5\u53c2\u6570\u4f1a\u989d\u5916\u5bf9\u4ee5\u901a\u7528\u5b57\u7b26\u540d\uff08UCN\uff09\u5f62\u5f0f\u8868\u8fbe\u7684\u53cc\u5411\u63a7\u5236\u5b57\u7b26\u53d1\u51fa\u8b66\u544a\uff0c\u5373\u5728\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u3001\u5b57\u7b26\u5e38\u91cf\u4e0e\u6807\u8bc6\u7b26\u4e2d\u4f7f\u7528\n```plaintext\n\\uXXXX\n```\n\u8bb0\u6cd5\u7684\u60c5\u51b5\u3002\n\n\u6ce8\u610f\u8be5\u9009\u9879\u5e76_\u4e0d_\u59a8\u788d\u521b\u5efa\u56fd\u9645\u5316\u7a0b\u5e8f\u3002\u5f53\u524d\u7684\u6700\u4f73\u5b9e\u8df5\u662f\u628a\u4eba\u7c7b\u53ef\u8bfb\u7684\u6587\u672c\u5b57\u7b26\u4e32\u653e\u5728\u5355\u72ec\u6587\u4ef6\u4e2d\uff0c\u800c\u4e0d\u662f\u653e\u5728\u6e90\u7801\u91cc\uff0c\u7136\u540e\u4f7f\u7528\n```plaintext\ngettext\n```\n\u8fd9\u7c7b\u56fd\u9645\u5316\uff08i18n\uff09\u6846\u67b6\uff0c\u4e3a\u7528\u6237\u7684\u533a\u57df\u8bbe\u7f6e\u53d6\u56de\u6b63\u786e\u6587\u672c\u3002\n\n### \u4f55\u65f6\u4e0d\u5e94\u4f7f\u7528\uff1f\n\n\u5f53\u9884\u671f\u90e8\u5206\u6e90\u7801_\u786e\u4f1a_\u5305\u542b\u53cc\u5411\u63a7\u5236\u5b57\u7b26\u65f6\uff0c_\u4e0d\u8981_\u4f7f\u7528\n```plaintext\n-Wbidi-chars=any\n```\n\u6216`-Wbidi-chars=any,ucn`\u3002\u5178\u578b\u60c5\u5f62\u662f\u90e8\u5206\u6e90\u7801\u6587\u672c\uff08\u5982\u6ce8\u91ca\uff09\u4f7f\u7528\u963f\u62c9\u4f2f\u8bed\u3001\u5e0c\u4f2f\u6765\u8bed\u3001\u6ce2\u65af\u8bed\u6216\u4e4c\u5c14\u90fd\u8bed\u8fd9\u7c7b\u4ece\u53f3\u5230\u5de6\u7684\u4e66\u5199\u7cfb\u7edf\u3002\u6b64\u7c7b\u60c5\u51b5\u4e0b\uff0c\u6539\u7528`-Wbidi-chars=unpaired`\uff08\u9ed8\u8ba4\u503c\uff09\u6216\n```plaintext\n-Wbidi-chars=unpaired,ucn\n```\n\u3002\n\n### \u989d\u5916\u8003\u91cf\n\n\u6700\u597d\u4e5f\u4f7f\u7528\u5176\u4ed6\u9759\u6001\u4ee3\u7801\u5206\u6790\u5de5\u5177\u5bf9\u6728\u9a6c\u6e90\u7801\u53d1\u51fa\u8b66\u544a\uff0c\u56e0\u4e3a\u8fd9\u4e0d\u662f\u5f00\u53d1\u8005\u901a\u5e38\u8003\u8651\u5230\u7684\u95ee\u9898\u3002\u6709\u4e9b\u7f16\u8f91\u5668\u6709\u5bf9\u6728\u9a6c\u6e90\u7801\u53d1\u51fa\u8b66\u544a\u7684\u673a\u5236\uff1b\u5728\u5b9e\u9645\u53ef\u884c\u65f6\u5e94\u4f7f\u7528\u5b83\u4eec\u3002\u4e0d\u8fc7\uff0c\u6709\u65f6\u5f88\u96be\u6838\u5b9e\u5f00\u53d1\u8005\u4e0e\u8bc4\u5ba1\u8005\u662f\u5426\u4f7f\u7528\u4e86\u8fd9\u7c7b\u5de5\u5177\u3002\n\n```plaintext\nclang-tidy\n```\n\u6709\u591a\u4e2a lint \u53ef\u5e2e\u52a9\u8bc6\u522b\u6728\u9a6c\u6e90\u7801\uff1a\n\n- `misc-misleading-bidirectional`\n\u68c0\u67e5\u4f1a\u5bf9\u672a\u7ec8\u6b62\u7684\u53cc\u5411 Unicode \u5e8f\u5217\u53d1\u51fa\u8b66\u544a\uff0c\u7c7b\u4f3c GCC \u7684\n```plaintext\n-Wbidi-chars=unpaired\n```\n[42]\u3002\n- `misc-confusable-identifiers`\n\u68c0\u67e5\u4f1a\u5bf9\u89c6\u89c9\u4e0a\u76f8\u4f3c\u7684\u5b57\u7b26\u53d1\u51fa\u8b66\u544a[43]\u3002\n- `misc-misleading-identifier`\n\u68c0\u67e5\u4f1a\u5bf9\u53ef\u80fd\u6539\u53d8\u4ee3\u7801\u542b\u4e49\u7684\u53cc\u5411 Unicode \u53d1\u51fa\u8b66\u544a[44]\u3002\n\n* * *\n\n### \u628a\u7f16\u8bd1\u5668\u8b66\u544a\u5f53\u4f5c\u9519\u8bef\n\n- **`-Werror` `-Werror=` _`<warning-flag>`_** \u2014 GCC 2.95.3\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u628a\u7f16\u8bd1\u5668\u8b66\u544a\u5f53\u4f5c\u9519\u8bef\u3002\n\n### \u6982\u8981\n\n\u8ba9\u7f16\u8bd1\u5668\u628a\u6240\u6709\u6216\u7279\u5b9a\u8b66\u544a\u8bca\u65ad\u5f53\u4f5c\u9519\u8bef\u3002\n\n\u4e0d\u5e26\u9009\u62e9\u5668\u7684\u4e00\u63fd\u5b50\u5f62\u5f0f\n```plaintext\n-Werror\n```\n\u628a\u6240\u6709\u8b66\u544a\u5f53\u4f5c\u9519\u8bef\uff0c\u53ef\u7528\u4e8e\u5728\u5f00\u53d1\u671f\u95f4\u5b9e\u65bd\u96f6\u8b66\u544a\u7b56\u7565\u3002\u4e0d\u8fc7\uff0c\u6211\u4eec\u5efa\u8bae\u5f00\u53d1\u8005\u5728\u5206\u53d1\u6e90\u7801\u65f6\u7701\u7565\u4e00\u63fd\u5b50\u5f62\u5f0f\uff0c\u56e0\u4e3a\u5b83\u4f1a\u9020\u6210\u5bf9\u7279\u5b9a\u5de5\u5177\u94fe\u5382\u5546\u4e0e\u7248\u672c\u7684\u4f9d\u8d56[45]\u3002\u5982\u6709\u5fc5\u8981\uff0c\u8fd9\u7c7b\u5de5\u5177\u94fe\u4f9d\u8d56\uff08\u5373\u9879\u76ee\u9884\u671f\u4e0e\u54ea\u4e9b\u7f16\u8bd1\u5668\u7248\u672c\u914d\u5408\u5de5\u4f5c\uff09\u5e94\u6e05\u695a\u8bb0\u5f55\u5728\u9879\u76ee\u6587\u6863\u4e2d\uff0c\u6216\u5e94\u5b8c\u6574\u6355\u83b7\u6784\u5efa\u73af\u5883\uff0c\u4f8b\u5982\u901a\u8fc7\u5bb9\u5668\u914d\u65b9\u3002\u4e0d\u8fc7\uff0c\u66f4\u597d\u7684\u505a\u6cd5\u662f\u786e\u4fdd\u6e90\u7801\u4e0d\u81f4\u5982\u6b64\u4f9d\u8d56\u7279\u5b9a\u5de5\u5177\u94fe\u7248\u672c\u3002\n\n\u5e26\u9009\u62e9\u5668\u7684\u9009\u62e9\u6027\u5f62\u5f0f `-Werror=<warning-flag>`\uff08\u6ce8\u610f\u5176\u4e2d\u7684\u9009\u62e9\u5668\uff09\uff0c\u53ef\u7528\u4e8e\u7cbe\u7ec6\u7684\u201c\u8b66\u544a\u5373\u9519\u8bef\u201d\u63a7\u5236\uff0c\u800c\u4e0d\u5f15\u5165\u4e00\u63fd\u5b50\u7684\u96f6\u8b66\u544a\u7b56\u7565\u3002\u8fd9\u6709\u5229\u4e8e\u786e\u4fdd\u67d0\u4e9b\u4e0d\u826f\u6784\u9020\u6216\u7f3a\u9677\u5728\u4ea7\u51fa\u7684\u6784\u5efa\u4e2d_\u6c38\u4e0d_\u51fa\u73b0\u3002\u82e5\u5bf9\u5e94\u8b66\u544a\u9488\u5bf9\u7279\u5b9a\u6784\u9020\uff0c\u9009\u62e9\u6027\u5f62\u5f0f\u5e76_\u4e0d_\u5f15\u5165\u5bf9\u5de5\u5177\u94fe\u6216\u7248\u672c\u7684\u4f9d\u8d56\u3002\u4f8b\u5982\u5f00\u53d1\u8005\u53ef\u4ee5\u51b3\u5b9a\u628a\u6307\u793a\u4e0e\u64cd\u4f5c\u7cfb\u7edf\u9632\u5fa1\u673a\u5236\u51b2\u7a81\u7684\u8b66\u544a\uff08\u5982`-Werror=trampolines`\uff09\u3001\u672a\u5b9a\u4e49\u884c\u4e3a\uff08\u5982`-Werror=return-type`\uff09\u6216\u4e0e\u8f6f\u4ef6\u5f31\u70b9\u76f8\u5173\u7684\u6784\u9020\uff08\u5982`-Werror=conversion`\uff09\u63d0\u5347\u4e3a\u9519\u8bef\u3002\u4f7f\u7528\u4e00\u7ec4\u9009\u62e9\u6027\n```plaintext\n-Werror\n```\n\u9009\u9879\uff0c\u6709\u52a9\u4e8e\u786e\u4fdd\u8f6f\u4ef6\u88ab\u79fb\u690d\u5230\u5e76\u6b63\u786e\u4f7f\u7528\u5176\u8bed\u8a00\u7684\u66f4\u65b0\u7248\u672c\uff08\u5e76\u907f\u514d\u4f7f\u7528\u98ce\u9669\u66f4\u9ad8\u6216\u6709\u95ee\u9898\u7684\u6784\u9020\uff09[46]\u3002\n\n\u96f6\u8b66\u544a\u7b56\u7565\u4e5f\u53ef\u4ee5\u5728 CI \u5c42\u9762\u5f3a\u5236\u6267\u884c\u3002\u51fa\u4e8e\u4e0a\u6587\u89e3\u91ca\u7684\u539f\u56e0\uff0c\u57fa\u4e8e CI \u7684\u96f6\u8b66\u544a\u6216\u6709\u754c\u8b66\u544a\u7b56\u7565\u5f80\u5f80\u66f4\u53ef\u53d6\uff0c\u800c\u4e14\u5b83\u4eec\u53ef\u4ee5\u6269\u5c55\u5230\u7f16\u8bd1\u5668\u8b66\u544a\u4e4b\u5916\u3002\u4f8b\u5982\u5b83\u4eec\u8fd8\u53ef\u4ee5\u5305\u542b\u9759\u6001\u5206\u6790\u5de5\u5177\u7684\u8b66\u544a\uff0c\u6216\u5728\u53d1\u73b0\n```plaintext\nFIXME\n```\n\u4e0e\n```plaintext\nTODO\n```\n\u6ce8\u91ca\u65f6\u751f\u6210\u8b66\u544a\u3002\n\n* * *\n\n### \u628a\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u4e14\u4e0d\u5e26\u53c2\u6570\u4f7f\u7528\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u5f53\u4f5c\u9519\u8bef\n\n- **`-Werror=format-security`** \u2014 GCC 2.95.3\u3001Clang 4.0.0 \u8d77\u652f\u6301\u3002\u628a\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u4e14\u4e0d\u5e26\u53c2\u6570\u4f7f\u7528\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u5f53\u4f5c\u9519\u8bef\u3002\n\n### \u6982\u8981\n\n\u628a\u5bf9 printf \u4e0e scanf \u7cfb\u5217\u51fd\u6570\u7684\u6b64\u7c7b\u8c03\u7528\u5f53\u4f5c\u9519\u8bef\uff1a\u683c\u5f0f\u5b57\u7b26\u4e32\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\uff0c\u4e14\u6ca1\u6709\u989d\u5916\u7684\u683c\u5f0f\u53c2\u6570\u3002\n\n\u53ef\u5728\u8fd0\u884c\u65f6\u88ab\u7a0b\u5e8f\u5916\u90e8\u5f71\u54cd\u7684\u683c\u5f0f\u5b57\u7b26\u4e32\u5f88\u53ef\u80fd\u9020\u6210\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e[47]\u3002\u6211\u4eec\u5efa\u8bae\u628a\u4e0d\u662f\u5b57\u7b26\u4e32\u5b57\u9762\u91cf\u4e14\u4e0d\u5e26\u989d\u5916\u53c2\u6570\u4f7f\u7528\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u5f53\u4f5c\u9519\u8bef\uff0c\u56e0\u4e3a\u5982\u4e0b\u5f62\u5f0f\u7684\u8c03\u7528\uff1a\n\n```C\nprintf(fmt);\nprintf(gettext(\"Hello World\\n\"));\nfprintf(stderr, fmt);\n```\n\n\u603b\u662f\u6307\u793a\u7740 bug\uff0c\u800c\u4e14\u5982\u679c\u683c\u5f0f\u5b57\u7b26\u4e32\u53ef\u88ab\u5916\u90e8\u8f93\u5165\u63a7\u5236\uff0c\u5c31\u53ef\u80fd\u88ab\u7528\u4e8e\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u653b\u51fb\u3002\u8fd9\u7c7b\u4ee3\u7801\u4e2d\uff0c\u82e5\u683c\u5f0f\u5b57\u7b26\u4e32\n```plaintext\nfmt\n```\n\u9884\u671f\u4e0d\u542b\u683c\u5f0f\u8bf4\u660e\u7b26\uff0c\u53ef\u7528\u56fa\u5b9a\u683c\u5f0f\u5b57\u7b26\u4e32\u6539\u5199\u4e3a\u5b89\u5168\u5f62\u5f0f\uff1a\n\n```C\nprintf(\"%s\", fmt);\nprintf(\"%s\", gettext(\"Hello World\\n\"));\nfprintf(stderr, \"%s\", fmt);\n```\n\n\u4e00\u4e9b Linux \u53d1\u884c\u7248\uff0c\u4f8b\u5982 Arch Linux[48]\u3001Fedora[49] \u4e0e Ubuntu[50]\uff0c\u5728\u4e3a\u53d1\u884c\u7248\u6784\u5efa\u8f6f\u4ef6\u65f6\u5f3a\u5236\u8981\u6c42\u4f7f\u7528\n```plaintext\n-Werror=format-security\n```\n\u3002\n\n* * *\n\n### \u628a\u8fc7\u65f6\u7684 C \u6784\u9020\u5f53\u4f5c\u9519\u8bef\n\n- **`-Werror=implicit`** \u2014 GCC 2.95.3\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u628a\u672a\u6307\u5b9a\u7c7b\u578b\u7684\u58f0\u660e\u3001\u4ee5\u53ca\u4f7f\u7528\u524d\u672a\u58f0\u660e\u7684\u51fd\u6570\u5f53\u4f5c\u9519\u8bef\u3002\n- **`-Werror=incompatible-pointer-types`** \u2014 GCC 5.1.0\u3001Clang 7.0.0 \u8d77\u652f\u6301\u3002\u628a\u7c7b\u578b\u4e0d\u517c\u5bb9\u7684\u6307\u9488\u4e4b\u95f4\u7684\u8f6c\u6362\u5f53\u4f5c\u9519\u8bef\u3002\n- **`-Werror=int-conversion`** \u2014 GCC 5.1.0\u3001Clang 2.6.0 \u8d77\u652f\u6301\u3002\u628a\u9690\u5f0f\u7684\u6574\u6570\u5230\u6307\u9488\u3001\u6307\u9488\u5230\u6574\u6570\u8f6c\u6362\u5f53\u4f5c\u9519\u8bef\u3002\n\n### \u6982\u8981\n\n\u8ba9\u7f16\u8bd1\u5668\u628a\u8fc7\u65f6\u7684 C \u6784\u9020\u5f53\u4f5c\u9519\u8bef\u3002\u8fd9\u4e9b\u9009\u9879\u53ea\u4e0e C \u4ee3\u7801\u76f8\u5173\u3002\n\nISO/IEC 9899:1999 \u6807\u51c6\uff08\u901a\u5e38\u79f0\u4e3a C99\uff09\u4ece C \u8bed\u8a00\u4e2d\u79fb\u9664\u4e86\u82e5\u5e72\u5411\u540e\u517c\u5bb9\u7279\u6027\uff0c\u4f8b\u5982\u9690\u5f0f\u51fd\u6570\u58f0\u660e\u4e0e\u9690\u5f0f\u8fd4\u56de\u7c7b\u578b\u3002\u7c7b\u4f3c\u5730\uff0c\u66f4\u65e9\u7684 C89/C90 \u6807\u51c6\uff08ANSI X3.159-1989 / ISO/IEC 9899:1990\uff09\u79fb\u9664\u4e86\u67d0\u4e9b\u9690\u5f0f\u7c7b\u578b\u8f6c\u6362\uff0c\u4f8b\u5982\u4ece\u6574\u6570\u5230\u6307\u9488\u7c7b\u578b\u7684\u9690\u5f0f\u8f6c\u6362\u3002\u8fd9\u7c7b\u9690\u5f0f\u58f0\u660e[51]\u4e0e\u7c7b\u578b\u8f6c\u6362\uff08\u65e0\u8bba\u9690\u5f0f\u8fd8\u662f\u663e\u5f0f[52]\uff09\u5bf9 C \u4ee3\u7801\u7684\u6b63\u786e\u6027\u4e0e\u5b89\u5168\u6027\u53ef\u88ab\u89c6\u4e3a\u5371\u9669\uff0c\u56e0\u4e3a\u5b83\u4eec\u5bfc\u81f4\u7c7b\u578b\u68c0\u67e5\u4e0d\u591f\u4e25\u683c\uff0c\u5e76\u53ef\u80fd\u4f9d\u8d56\u5b9e\u73b0\u5b9a\u4e49\u7684\u884c\u4e3a\u3002\u7136\u800c\u73b0\u4ee3\u7f16\u8bd1\u5668\u9ed8\u8ba4\u4ecd\u63a5\u53d7\u8fd9\u4e9b\u8fc7\u65f6\u6784\u9020\uff0c\u9664\u975e\u88ab\u8981\u6c42\u53ea\u8981\u57fa\u7840\u6807\u51c6\u8981\u6c42\u5c31\u4e25\u683c\u62a5\u9519\u3002\n\n```plaintext\n-Werror=implicit\n```\n\u3001`-Werror=incompatible-pointer-types`\u4e0e\n```plaintext\n-Werror=int-conversion\n```\n\u9009\u9879\u6307\u793a\u7f16\u8bd1\u5668\u628a\u4ee5\u4e0b\u8fc7\u65f6\u6784\u9020\u5f53\u4f5c\u9519\u8bef\uff1a\n\n- \u672a\u6307\u5b9a\u7c7b\u578b\u7684\u58f0\u660e\uff0c\u6216\u4f7f\u7528\u524d\u672a\u58f0\u660e\u7684\u51fd\u6570\u3002\n- \u7c7b\u578b\u4e0d\u517c\u5bb9\u7684\u6307\u9488\u4e4b\u95f4\u7684\u8f6c\u6362\u3002\n- \u9690\u5f0f\u7684\u6574\u6570\u5230\u6307\u9488\u3001\u6307\u9488\u5230\u6574\u6570\u8f6c\u6362\u3002\n\n\u4f7f\u7528\u8fd9\u4e9b\u9009\u9879\u5c06\u4f7f\u7f16\u8bd1\u5668\u628a\u76f8\u5e94\u8fc7\u65f6\u6784\u9020\u5f53\u4f5c\u9519\u8bef\uff0c\u65e0\u8bba\u7f16\u8bd1\u5668\u88ab\u6307\u793a\u9075\u5faa\u54ea\u79cd\u8bed\u8a00\u6807\u51c6\u3002GCC 14[53] \u4e0e Clang 15[54] \u9ed8\u8ba4\u5df2\u7981\u7528\u5bf9\u8fd9\u4e9b\u9057\u7559\u8bed\u8a00\u6784\u9020\u7684\u652f\u6301\uff0c\u56e0\u6b64\u542f\u7528\u8fd9\u4e9b\u9009\u9879\u4e5f\u80fd\u4e3a\u4ee3\u7801\u5e93\u8fc1\u79fb\u5230\u8fd9\u4e9b\u53ca\u66f4\u65b0\u7684\u7f16\u8bd1\u5668\u505a\u597d\u51c6\u5907\u3002\u4e00\u4e9b Linux \u53d1\u884c\u7248\uff08\u5982 Fedora[46]\uff09\u5728\u4e3a\u53d1\u884c\u7248\u6784\u5efa\u8f6f\u4ef6\u65f6\u5f3a\u5236\u8981\u6c42\u4f7f\u7528\u8fd9\u4e9b\u9009\u9879\u3002\u6211\u4eec\u5efa\u8bae\u5f00\u53d1\u8005\u91c7\u7528\u8fd9\u4e9b\u9009\u9879\uff0c\u56e0\u4e3a\u5728\u4f9d\u8d56\u8fc7\u65f6\u6784\u9020\u7684\u4ee3\u7801\u5e93\u4e2d\u542f\u7528\u5b83\u4eec\u53ef\u80fd\u9700\u8981\u5bf9\u6e90\u7801\u505a\u51fa\u4e0d\u5c0f\u7684\u6539\u52a8\u3002\n\n\u7279\u522b\u8981\u6ce8\u610f\uff0c\u5728\u5b58\u5728\u9690\u5f0f\u51fd\u6570\u58f0\u660e\u7684\u60c5\u51b5\u4e0b\uff0c\n```plaintext\n_FORTIFY_SOURCE\n```\n\u7684\u4f5c\u7528\u8981\u4e48\u6709\u9650\uff0c\u8981\u4e48\u5b8c\u5168\u5931\u6548\u3002\n\n\u6ce8\u610f\u6b64\u5904\u5217\u51fa\u7684\u9009\u9879\u5e76\u672a\u6db5\u76d6\u88ab\u79fb\u9664\u7279\u6027\u7684\u5b8c\u6574\u6e05\u5355\u3002\u67d0\u4e9b\u9884\u671f\u7684\u7f16\u8bd1\u5668\u9ed8\u8ba4\u503c\u53d8\u66f4\u65e0\u6cd5\u901a\u8fc7\u7f16\u8bd1\u5668\u9009\u9879\u9884\u89c8\uff0c\u800c\u9700\u8981\u6307\u793a\u7f16\u8bd1\u5668\u652f\u6301\u7279\u5b9a\u8bed\u8a00\u6807\u51c6\uff08C99 \u6216\u66f4\u665a\u65b9\u8a00\uff09\uff0c\u5e76\u5728\u57fa\u7840\u6807\u51c6\u8981\u6c42\u8bca\u65ad\u65f6\u7ed9\u51fa\u9519\u8bef[55]\u3002\n\n\u6709\u4e9b\u5de5\u5177\uff08\u5982\n```plaintext\nautoconf\n```\n\uff09\u4f1a\u901a\u8fc7\u751f\u6210\u4ee3\u7801\u5e76\u7f16\u8bd1\u6765\u81ea\u52a8\u5224\u65ad\u7f16\u8bd1\u5668\u652f\u6301\u4ec0\u4e48\u3002\u8fd9\u4e9b\u5de5\u5177\u7684\u65e7\u7248\u672c\u5185\u90e8\u53ef\u80fd\u672a\u91c7\u7528\u8f83\u73b0\u4ee3\u7684\u505a\u6cd5\uff0c\u56e0\u6b64\u542f\u7528\u9519\u8bef\u53ef\u80fd\u5bfc\u81f4\u8bef\u62a5\u67d0\u4e9b\u529f\u80fd\u4e0d\u53ef\u7528\u3002\u6700\u597d\u7684\u89e3\u51b3\u529e\u6cd5\u662f\u66f4\u65b0\u8be5\u5de5\u5177\u3002\u82e5\u65e0\u6cd5\u66f4\u65b0\uff0c\u53ef\u8003\u8651\u5728\u8be5\u5de5\u5177\u5224\u65ad\u51fa\u7f16\u8bd1\u5668\u6240\u652f\u6301\u673a\u5236_\u4e4b\u540e_\uff0c\u518d\u52a0\u5165\n```plaintext\n-Werror\n```\n\u5f62\u5f0f\u3002\n\n### \u989d\u5916\u8003\u91cf\n\nClang \u4e0e GCC 5.1\u20138.3 \u5141\u8bb8\u5728\u7f16\u8bd1 C++ \u4ee3\u7801\u65f6\u6307\u5b9a\u8fd9\u4e9b\u9009\u9879\uff0c\u5c3d\u7ba1\u5b83\u4eec\u4e0d\u4f1a\u4ea7\u751f\u4efb\u4f55\u6548\u679c\uff0c\u56e0\u4e3a\u8fd9\u4e9b\u6784\u9020\u5728 C++ \u4e2d\u672c\u5df2\u975e\u6cd5\u3002GCC 8.4 \u53ca\u4e4b\u540e\u7248\u672c\u4f1a\u8b66\u544a\u8fd9\u4e9b\u9009\u9879\u5bf9 C++ \u65e0\u6548\u3002\n\n* * *\n\n### \u4e3a\u4e0d\u5b89\u5168\u7684 libc \u7528\u6cd5\u4e0e\u7f13\u51b2\u533a\u6ea2\u51fa\u52a0\u56fa\u6e90\u7801\n\n- **`-D_FORTIFY_SOURCE=3`** \u2014 GCC 12.0.0\u3001Clang 9.0.0 \u8d77\u652f\u6301[2]\u3002\u68c0\u67e5\u4e0e `-D_FORTIFY_SOURCE=2` \u76f8\u540c\uff0c\u4f46\u53d7\u52a0\u56fa\u7684\u8c03\u7528\u663e\u8457\u66f4\u591a\uff0c\u5728\u5c11\u6570\u60c5\u51b5\u4e0b\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\u9700\u8981 `-O1` \u6216\u66f4\u9ad8\u3002\n- **`-D_FORTIFY_SOURCE=2`** \u2014 GCC 4.0.0\u3001Clang 5.0.0 \u8d77\u652f\u6301[2]\u3002\u9664 `-D_FORTIFY_SOURCE=1` \u8986\u76d6\u7684\u68c0\u67e5\u5916\uff0c\u8fd8\u4f1a\u62e6\u622a\u53ef\u80fd\u7b26\u5408 C \u6807\u51c6\u4f46\u4ecd\u4e0d\u5b89\u5168\u7684\u4ee3\u7801\u3002\u9700\u8981 `-O1` \u6216\u66f4\u9ad8\u3002\n- **`-D_FORTIFY_SOURCE=1`** \u2014 GCC 4.0.0\u3001Clang 5.0.0 \u8d77\u652f\u6301\u3002\u4ee5\u7f16\u8bd1\u671f\u4e0e\u8fd0\u884c\u65f6\u68c0\u67e5\u52a0\u56fa\u6e90\u7801\uff0c\u9488\u5bf9\u4e0d\u5b89\u5168\u7684 libc \u7528\u6cd5\u4e0e\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\n\n### \u6982\u8981\n\n```plaintext\n_FORTIFY_SOURCE\n```\n\u5b8f\u542f\u7528\u4e00\u7ec4\u5bf9 GNU C \u5e93\uff08glibc\uff09\u7684\u6269\u5c55\uff0c\u4f7f\u82e5\u5e72\u51fd\u6570\u7684\u5165\u53e3\u70b9\u8fdb\u884c\u68c0\u67e5\uff0c\u4e00\u65e6\u9047\u5230\u4e0d\u5b89\u5168\u884c\u4e3a\u7acb\u5373\u4e2d\u6b62\u6267\u884c\u3002\u8be5\u68c0\u67e5\u7684\u5173\u952e\u7279\u6027\u662f\u9a8c\u8bc1\u4f20\u7ed9\u8fd9\u4e9b\u51fd\u6570\u8c03\u7528\u7684\u5bf9\u8c61\uff0c\u786e\u4fdd\u8c03\u7528\u4e0d\u4f1a\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u8fd9\u4f9d\u8d56\u7f16\u8bd1\u5668\u80fd\u5728\u7f16\u8bd1\u671f\u7b97\u51fa\u88ab\u4fdd\u62a4\u5bf9\u8c61\u7684\u5927\u5c0f\u3002\u8fd9\u4e9b\u51fd\u6570\u7684\u5b8c\u6574\u6e05\u5355\u7ef4\u62a4\u5728 GNU C \u5e93\u624b\u518c\u4e2d[56]\uff1a\n\n> memcpy\u3001mempcpy\u3001memmove\u3001memset\u3001strcpy\u3001stpcpy\u3001strncpy\u3001strcat\u3001strncat\u3001sprintf\u3001vsprintf\u3001snprintf\u3001vsnprintf\u3001gets\n\n```plaintext\n_FORTIFY_SOURCE\n```\n\u673a\u5236\u6709\u4e09\u79cd\u5de5\u4f5c\u6a21\u5f0f\uff1a\n\n- `-D_FORTIFY_SOURCE=1`\uff1a\u4fdd\u5b88\u7684\u7f16\u8bd1\u671f\u4e0e\u8fd0\u884c\u65f6\u68c0\u67e5\uff1b\u4e0d\u4f1a\u6539\u53d8\u7a0b\u5e8f\uff08\u5df2\u5b9a\u4e49\u7684\uff09\u884c\u4e3a\u3002\u5f53\u7f16\u8bd1\u5668\u80fd\u4e3a\u88ab\u4fdd\u62a4\u5bf9\u8c61\u4f30\u7b97\u51fa\u7f16\u8bd1\u671f\u5e38\u91cf\u5927\u5c0f\u65f6\uff0c\u542f\u7528\u6ea2\u51fa\u68c0\u67e5\u3002\n- `-D_FORTIFY_SOURCE=2`\uff1a\u66f4\u4e25\u683c\u7684\u68c0\u67e5\uff0c\u4e5f\u4f1a\u68c0\u51fa\u867d\u7b26\u5408 C \u6807\u51c6\u4f46\u53ef\u80fd\u4e0d\u5b89\u5168\u7684\u884c\u4e3a\uff1b\u53ef\u80fd\u901a\u8fc7\u7981\u6b62\u67d0\u4e9b\u7f16\u7a0b\u6784\u9020\u5f71\u54cd\u7a0b\u5e8f\u884c\u4e3a\u3002\u8fd9\u7c7b\u68c0\u67e5\u7684\u4e00\u4e2a\u4f8b\u5b50\u662f\u628a\n```plaintext\n%n\n```\n\u683c\u5f0f\u8bf4\u660e\u7b26\u9650\u5236\u4e3a\u53ea\u8bfb\u683c\u5f0f\u5b57\u7b26\u4e32\u3002\n- `-D_FORTIFY_SOURCE=3`\uff1a\u68c0\u67e5\u4e0e\n```plaintext\n-D_FORTIFY_SOURCE=2\n```\n\u8986\u76d6\u7684\u76f8\u540c\uff0c\u533a\u522b\u5728\u4e8e\u5373\u4f7f\u7f16\u8bd1\u5668\u53ea\u80fd\u628a\u88ab\u4fdd\u62a4\u5bf9\u8c61\u7684\u5927\u5c0f\u4f30\u7b97\u4e3a\u8868\u8fbe\u5f0f\uff08\u800c\u4e0d\u53ea\u662f\u7f16\u8bd1\u671f\u5e38\u91cf\uff09\uff0c\u4e5f\u542f\u7528\u68c0\u67e5\u3002\n\n\u8981\u4ece\n```plaintext\n_FORTIFY_SOURCE\n```\n\u68c0\u67e5\u4e2d\u53d7\u76ca\uff0c\u5fc5\u987b\u6ee1\u8db3\u4ee5\u4e0b\u8981\u6c42\uff1a\n\n- \u5e94\u7528\u7a0b\u5e8f\u5fc5\u987b\u7528\n```plaintext\n-O1\n```\n\u6216\u66f4\u9ad8\u4f18\u5316\u6784\u5efa\uff1b\u5efa\u8bae\u81f3\u5c11\n```plaintext\n-O2\n```\u3002\n- \u7f16\u8bd1\u5668\u5e94\u80fd\u5728\u7f16\u8bd1\u671f\u4f30\u7b97\u76ee\u6807\u7f13\u51b2\u533a\u7684\u5927\u5c0f\u3002\u5e94\u7528\u7a0b\u5e8f\u4e0e\u5e93\u53ef\u901a\u8fc7\u4f7f\u7528 GCC \u4e0e Clang \u652f\u6301\u7684\u51fd\u6570\u5c5e\u6027\u6269\u5c55\u6765\u5e2e\u52a9\u505a\u5230\u8fd9\u70b9[57]\u3002\n- \u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u5fc5\u987b\u4f7f\u7528\u4e0a\u8ff0\u51fd\u6570\u7684 glibc \u7248\u672c\uff08\u968f\u6807\u51c6\u5934\u6587\u4ef6\u63d0\u4f9b\uff0c\u4f8b\u5982\n```plaintext\n\n```\n\u4e0e\n```plaintext\n\n```\n\uff09\n\n\u82e5\n```plaintext\n_FORTIFY_SOURCE\n```\n\u6dfb\u52a0\u7684\u68c0\u67e5\u5728\u8fd0\u884c\u65f6\u68c0\u51fa\u4e0d\u5b89\u5168\u884c\u4e3a\uff0c\u5b83\u4eec\u4f1a\u6253\u5370\u9519\u8bef\u6d88\u606f\u5e76\u7ec8\u6b62\u5e94\u7528\u7a0b\u5e8f\u3002\n\nFORTIFY_SOURCE \u7684\u9ed8\u8ba4\u6a21\u5f0f\u53ef\u80fd\u5df2\u9488\u5bf9\u67d0\u7f16\u8bd1\u5668\u9884\u5b9a\u4e49\uff0c\u4f8b\u5982 Ubuntu 22.04 \u9644\u5e26\u7684 GCC \u9ed8\u8ba4\u4f7f\u7528 FORTIFY_SOURCE=2\u3002\u82e5\u5728\u547d\u4ee4\u884c\u4e0a\u8bbe\u7f6e\u7684 FORTIFY_SOURCE \u6a21\u5f0f\u4e0e\u9ed8\u8ba4\u503c\u4e0d\u540c\uff0c\u7f16\u8bd1\u5668\u4f1a\u8b66\u544a\u91cd\u65b0\u5b9a\u4e49\u4e86 FORTIFY_SOURCE \u5b8f\u3002\u8981\u907f\u514d\u8fd9\u4e00\u70b9\uff0c\u53ef\u5728\u8bbe\u7f6e\u6240\u9700\u503c\u4e4b\u524d\u7528 -U_FORTIFY_SOURCE \u53d6\u6d88\u9884\u5b9a\u4e49\u6a21\u5f0f\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n```plaintext\n_FORTIFY_SOURCE=1\n```\n\u4e0e\n```plaintext\n_FORTIFY_SOURCE=2\n```\n\u7684\u8fd0\u884c\u65f6\u6027\u80fd\u5f71\u54cd\u9884\u671f\u53ef\u4ee5\u5ffd\u7565\uff08\u7ea6 0.1%\uff09\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u6240\u6709\u4f9d\u8d56 glibc \u7684\u5e94\u7528\u7a0b\u5e8f\u90fd\u63a8\u8350\u542f\u7528\n```plaintext\n_FORTIFY_SOURCE\n```\n\uff0c\u5e94\u5f53\u5e7f\u6cdb\u90e8\u7f72\u3002\u5404\u5927 Linux \u53d1\u884c\u7248\u4e2d\u7684\u591a\u6570\u8f6f\u4ef6\u5305\u81f3\u5c11\u542f\u7528\u4e86\n```plaintext\n_FORTIFY_SOURCE=2\n```\n\uff0c\u6709\u4e9b\u751a\u81f3\u542f\u7528\u4e86\n```plaintext\n_FORTIFY_SOURCE=3\n```\n\u3002\u5728\u5c11\u6570\u60c5\u51b5\u4e0b\n```plaintext\n_FORTIFY_SOURCE\n```\n\u53ef\u80fd\u7834\u574f\u73b0\u6709\u5e94\u7528\u7a0b\u5e8f\uff1a\n\n*   \u5982\u679c\u52a0\u56fa\u540e\u7684 glibc \u51fd\u6570\u8c03\u7528\u5728\u4f60\u7684\u5e94\u7528\u6027\u80fd\u5256\u6790\u4e2d\u663e\u793a\u4e3a\u70ed\u70b9\uff0c`_FORTIFY_SOURCE`\u53ef\u80fd\u5e26\u6765\u8d1f\u9762\u6027\u80fd\u5f71\u54cd\u3002\u8fd9\u5e76\u4e0d\u662f\u5e38\u89c1\u6216\u666e\u904d\u7684\u6027\u80fd\u4e0b\u964d [57]\uff0c\u4f46\u82e5\u89c2\u5bdf\u5230\u7531\u6b64\u9009\u9879\u5bfc\u81f4\u7684\u53d8\u6162\uff0c\u503c\u5f97\u7559\u610f\u3002\n\n*   \u5728\u7ed3\u6784\u4f53\u4e2d\u4f7f\u7528 GNU \u67d4\u6027\u6570\u7ec4\u6210\u5458\uff08flexible array members\uff09\u6269\u5c55\u7684\u5e94\u7528\u7a0b\u5e8f [58]\uff0c\u53ef\u80fd\u8ba9\u7f16\u8bd1\u5668\u8bef\u5224\u5bf9\u8c61\u6bd4\u5b9e\u9645\u66f4\u5c0f\uff0c\u4ece\u800c\u4ea7\u751f\u865a\u5047\u7684\u4e2d\u6b62\uff08abort\uff09\u3002\u5b89\u5168\u7684\u89e3\u51b3\u529e\u6cd5\u662f\u628a\u8fd9\u4e9b\u7528\u6cd5\u79fb\u690d\u5230 C99 \u67d4\u6027\u6570\u7ec4\uff1b\u82e5\u505a\u4e0d\u5230\uff08\u4f8b\u5982\u9700\u8981\u652f\u6301\u4e0d\u652f\u6301 C99 \u67d4\u6027\u6570\u7ec4\u7684\u7f16\u8bd1\u5668\uff09\uff0c\u53ef\u80fd\u4e0d\u5f97\u4e0d\u964d\u7ea7\u6216\u5173\u95ed`_FORTIFY_SOURCE`\u4fdd\u62a4\u3002\n\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u5728\u5185\u90e8\uff0c\n```plaintext\n-D_FORTIFY_SOURCE\n```\n\u4f9d\u8d56 GCC [59] \u4e0e Clang [60] \u4e2d\u7684\u5bf9\u8c61\u5927\u5c0f\u68c0\u67e5\u5185\u5efa\u51fd\u6570\uff0c\u5373\n```plaintext\n__builtin_object_size\n```\n\u4e0e\n```plaintext\n__builtin_dynamic_object_size\n```\n\u3002\u8fd9\u4e9b\u5185\u5efa\u51fd\u6570\u7ed9\u51fa\u5bf9\u8c61\u5927\u5c0f\u7684\u4fdd\u5b88\u8fd1\u4f3c\u503c\uff0c\u5e76\u4e14\u5bf9\u7f16\u8bd1\u5668\u4f18\u5316\u654f\u611f\u3002\u5f00\u542f\u4f18\u5316\u540e\u5b83\u4eec\u80fd\u7ed9\u51fa\u66f4\u51c6\u786e\u7684\u4f30\u8ba1\uff0c\u5c24\u5176\u662f\u5f53\n```plaintext\n__builtin_object_size\n```\n\u7684\u8c03\u7528\u4e0e\u5176\u53c2\u6570\u6307\u9488\u5f62\u6210\u7684\u51fd\u6570\u4e0d\u662f\u540c\u4e00\u4e2a\u51fd\u6570\u65f6\u3002\u6b64\u5916\uff0cGCC \u5728\u66f4\u9ad8\u4f18\u5316\u7ea7\u522b\u4e0b\u80fd\u786e\u5b9a\u66f4\u591a\u5173\u4e8e\u5b50\u5bf9\u8c61\u8fb9\u754c\u7684\u4fe1\u606f\u3002\u56e0\u6b64\u6211\u4eec\u5efa\u8bae\u4ee5\u81f3\u5c11\n```plaintext\n-O2\n```\n\u4f18\u5316\u7ea7\u522b\u542f\u7528\n```plaintext\n-D_FORTIFY_SOURCE=3\n```\n\u3002\n\n\u9519\u8bef\u5730\u4f7f\u7528\n```plaintext\nmalloc_usable_size\n```\n[61] \u53bb\u4f7f\u7528\u8be5\u51fd\u6570\u62a5\u544a\u7684\u989d\u5916\u5927\u5c0f\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ef\u80fd\u5728\u8fd0\u884c\u65f6\u4e2d\u6b62\u3002\u8fd9\u662f\u5e94\u7528\u7a0b\u5e8f\u7684\u7f3a\u9677\uff0c\u56e0\u4e3a\n```plaintext\nmalloc_usable_size\n```\n\u62a5\u544a\u7684\u989d\u5916\u5927\u5c0f\u901a\u5e38\u5e76\u4e0d\u5b89\u5168\u53ef\u89e3\u5f15\u7528\uff0c\u4ec5\u4f9b\u53c2\u8003\u8bca\u65ad\u4e4b\u7528\u3002\u6b64\u7c7b\u95ee\u9898\u7684\u6b63\u786e\u4fee\u590d\u65b9\u5f0f\u662f\u907f\u514d\u4f7f\u7528\n```plaintext\nmalloc_usable_size\n```\n\uff0c\u56e0\u4e3a glibc \u624b\u518c\u660e\u786e\u6307\u51fa\u5b83\u4ec5\u7528\u4e8e\u8bca\u65ad\u76ee\u7684 [61]\u3002\u5728\u8bb8\u591a Linux \u7cfb\u7edf\u4e0a\uff0c\u53ef\u4ee5\u901a\u8fc7\u5bf9 ELF \u4e8c\u8fdb\u5236\u8fd0\u884c\n```plaintext\nreadelf -Ws \n```\n\u5e76\u641c\u7d22\n```plaintext\nmalloc_usable_size@GLIBC\n```\n\u6765\u53d1\u73b0\u8fd9\u4e9b\u9519\u8bef\u7528\u6cd5 [62]\u3002\u5982\u679c\u65e0\u6cd5\u907f\u514d\u4f7f\u7528\n```plaintext\nmalloc_usable_size\n```\n\uff0c\u53ef\u4ee5\u8c03\u7528\n```plaintext\nrealloc\n```\n\u628a\u5757\u8c03\u6574\u4e3a\u53ef\u7528\u5927\u5c0f\uff0c\u4ece\u800c\u53d7\u76ca\u4e8e\n```plaintext\n_FORTIFY_SOURCE=3\n```\n\u3002\n\n\u53e6\u5916\uff0c\n```plaintext\n_FORTIFY_SOURCE\n```\n\u76ee\u524d\u4e0e [AddressSanitizer](https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html#-fsanitize=address) \u4e0d\u517c\u5bb9\uff08\u4e0e\u5176\u4ed6 sanitizer \u4ea6\u7136 [63]\uff09\uff0c\u56e0\u4e3a\u5b83\u4eec\u4e0d\u652f\u6301\u6e90\u7801\u52a0\u56fa\u3002\u56e0\u6b64\uff0c\u5728\u542f\u7528\u4e86\u6e90\u7801\u52a0\u56fa\u7684\u4e8c\u8fdb\u5236\u4e0a\uff0csanitizer \u53ef\u80fd\u884c\u4e3a\u5f02\u5e38\uff08\u8981\u4e48\u4ea7\u751f\u6f0f\u62a5\uff0c\u8981\u4e48\u4ea7\u751f\u8bef\u62a5\uff09\u3002\u6240\u4ee5\u4e0d\u5efa\u8bae\u5728\u4f7f\u7528\u4e86 sanitizer \u7684\u63d2\u6869\u6d4b\u8bd5\u6784\u5efa\u4e2d\u542f\u7528\n```plaintext\n_FORTIFY_SOURCE\n```\n\u3002\u7531\u4e8e\u591a\u6570 Linux \u53d1\u884c\u7248\u9ed8\u8ba4\u542f\u7528\n```plaintext\n_FORTIFY_SOURCE\n```\n[18]\uff0c\u5728\u6b64\u7c7b sanitizer \u63d2\u6869\u7684\u6d4b\u8bd5\u6784\u5efa\u4e2d\u53ef\u80fd\u9700\u8981\u663e\u5f0f\u5173\u95ed\u5b83\u3002\n\n* * *\n\n### C++ \u6807\u51c6\u5e93\u8c03\u7528\u7684\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\n\n- **`-D_GLIBCXX_ASSERTIONS`**\uff08libstdc++ 6.0.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libstdc++ \u7684 C++\uff09\u5bf9 GNU libstdc++ \u8c03\u7528\u505a\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff1b\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_GLIBCXX_DEBUG`**\uff08libstdc++ 3.4.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libstdc++ \u7684 C++\uff09\u5bf9 GNU libstdc++ \u8c03\u7528\u505a\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff1b\u4f1a\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST`**\uff08libc++ 18.1.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libc++ \u7684 C++\uff09\u5bf9 LLVM/Clang libc++ \u8c03\u7528\u505a\u5feb\u901f\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff1b\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE`**\uff08libc++ 18.1.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libc++ \u7684 C++\uff09\u5bf9 LLVM/Clang libc++ \u8c03\u7528\u505a\u5e7f\u6cdb\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff1b\u53ef\u80fd\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG`**\uff08libc++ 18.1.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libc++ \u7684 C++\uff09\u5bf9 LLVM/Clang libc++ \u8c03\u7528\u505a\u8c03\u8bd5\u7ea7\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff1b\u4f1a\u5f71\u54cd\u6027\u80fd\u3002\n- **`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_NONE`**\uff08libc++ 18.1.0\uff09\uff1a\uff08\u4ec5\u9002\u7528\u4e8e\u4f7f\u7528 libc++ \u7684 C++\uff09\u4e0d\u505a\u68c0\u67e5\u7684 LLVM/Clang libc++ \u8c03\u7528\uff08\u9ed8\u8ba4\u503c\uff09\u3002\n\n### \u6982\u8ff0\n\nGCC \u4e2d\u7684 C++ \u6807\u51c6\u5e93\u5b9e\u73b0\uff08libstdc++\uff09\u4e0e LLVM/Clang \u7684\u5b9e\u73b0\uff08libc++\uff09\u4e3a C++ \u6807\u51c6\u5e93\u8c03\u7528\u63d0\u4f9b\u8fd0\u884c\u65f6\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\uff0c\u4f8b\u5982 C++ \u5b57\u7b26\u4e32\u4e0e\u5bb9\u5668\u7684\u8fb9\u754c\u68c0\u67e5\u3001\u89e3\u5f15\u7528\u667a\u80fd\u6307\u9488\u65f6\u7684\u7a7a\u6307\u9488\u68c0\u67e5\u3002\n\n\u8fd9\u4e9b\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\u53ef\u4ee5\u901a\u8fc7\u5728\u7f16\u8bd1\u8c03\u7528 libstdc++ \u7684 C++ \u4ee3\u7801\u65f6\u5b9a\u4e49\n```plaintext\n-D_GLIBCXX_ASSERTIONS\n```\n\u5b8f\u6765\u542f\u7528 [64]\uff0c\u6216\u8005\u5bf9\u8c03\u7528 libc++ \u7684 C++ \u4ee3\u7801\u628a\n```plaintext\n-D_LIBCPP_HARDENING_MODE\n```\n\u5b9a\u4e49\u4e3a\u5408\u9002\u7684\u503c\u6765\u542f\u7528 [65]\u3002\n\n\u5bf9\u4e8e\u591a\u6570 C++ \u5e94\u7528\u7a0b\u5e8f\uff0c\u751f\u4ea7\u914d\u7f6e\u4e2d\u63a8\u8350\n```plaintext\n-D_GLIBCXX_ASSERTIONS\n```\n\u6216\n```plaintext\n-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST\n```\n\u3002\u5bf9\u4e8e\u975e\u751f\u4ea7\u7684\u6d4b\u8bd5\u6784\u5efa\uff0clibstdc++ \u4e0a\u63a8\u8350\n```plaintext\n-D_GLIBCXX_DEBUG\n```\n[66]\uff0clibc++ \u4e0a\u63a8\u8350\n```plaintext\n-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG\n```\n\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u591a\u6570 C++ \u6807\u51c6\u5e93\u8c03\u7528\u90fd\u6709\u524d\u7f6e\u6761\u4ef6\u3002\u6709\u4e9b\u524d\u7f6e\u6761\u4ef6\u53ef\u4ee5\u5728\u5e38\u6570\u65f6\u95f4\u5185\u68c0\u67e5\uff0c\u53e6\u4e00\u4e9b\u4ee3\u4ef7\u66f4\u9ad8\u3002\n```plaintext\n-D_GLIBCXX_ASSERTIONS\n```\n\u542f\u7528\u7684\u68c0\u67e5\u529b\u6c42\u8f7b\u91cf [67]\uff0c\u5373\u5e38\u6570\u65f6\u95f4\u68c0\u67e5\uff0c\u4f46\u5177\u4f53\u884c\u4e3a\u5728\u4e0d\u540c\u6807\u51c6\u5e93\u7248\u672c\u95f4\u53ef\u80fd\u6709\u5dee\u5f02\u3002\u5728\u67d0\u4e9b\u7248\u672c\u7684 libstdc++ \u4e2d\uff0c\n```plaintext\n-D_GLIBCXX_ASSERTIONS\n```\n\u5b8f\u53ef\u80fd\u5bf9\u6027\u80fd\u6709\u975e\u5e73\u51e1\u7684\u5f71\u54cd\uff0c\u636e\u62a5\u9053\u6700\u591a\u53ef\u5bfc\u81f4 6% \u7684\u51cf\u901f [68]\u3002\n\n```plaintext\n-D_LIBCPP_HARDENING_MODE\n```\n\u5b8f\u5bf9 libc++ \u4e2d\u7684\u5404\u7c7b\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\u63d0\u4f9b\u66f4\u7ec6\u7c92\u5ea6\u7684\u63a7\u5236\u3002\u53ef\u7528\u7684\u52a0\u56fa\u6a21\u5f0f\u6709\uff1a\n\n*   **\u5feb\u901f\u6a21\u5f0f**\uff08`_LIBCPP_HARDENING_MODE_FAST`\uff09\u5305\u542b\u5bf9\u5b89\u5168\u81f3\u5173\u91cd\u8981\u3001\u5f00\u9500\u76f8\u5bf9\u8f83\u5c0f\u7684\u68c0\u67e5\uff0c\u5373\u6253\u7b97\u5728\u751f\u4ea7\u4e2d\u4f7f\u7528\u7684\u5e38\u6570\u65f6\u95f4\u68c0\u67e5\u3002\n\n*   **\u5e7f\u6cdb\u6a21\u5f0f**\uff08`_LIBCPP_HARDENING_MODE_EXTENSIVE`\uff09\u5305\u542b\u5feb\u901f\u6a21\u5f0f\u7684\u5168\u90e8\u68c0\u67e5\uff0c\u5916\u52a0\u4e00\u4e9b\u9488\u5bf9\u672a\u5b9a\u4e49\u884c\u4e3a\u3001\u5f00\u9500\u76f8\u5bf9\u8f83\u5c0f\u4f46\u5e76\u975e\u5b89\u5168\u5173\u952e\u7684\u68c0\u67e5\u3002\u5e7f\u6cdb\u6a21\u5f0f\u5bf9\u6027\u80fd\u7684\u5f71\u54cd\u5927\u4e8e\u5feb\u901f\u6a21\u5f0f\u3002\n\n*   **\u8c03\u8bd5\u6a21\u5f0f**\uff08`_LIBCPP_HARDENING_MODE_DEBUG`\uff09\u542f\u7528\u5168\u90e8\u68c0\u67e5\uff0c\u5305\u62ec\u53ef\u80fd\u6709\u663e\u8457\u6027\u80fd\u5f00\u9500\u7684\u542f\u53d1\u5f0f\u68c0\u67e5\u4ee5\u53ca\u5e93\u5185\u90e8\u65ad\u8a00\u3002\n\n*   **\u4e0d\u68c0\u67e5\u6a21\u5f0f**\uff08`_LIBCPP_HARDENING_MODE_NONE`\uff09\u5173\u95ed\u6240\u6709\u52a0\u56fa\u68c0\u67e5\u3002\n\n\n\u6bcf\u79cd\u6a21\u5f0f\u5177\u4f53\u542f\u7528\u4e86\u54ea\u4e9b\u65ad\u8a00\u7c7b\u522b\uff0c\u53ef\u67e5\u9605\u5bf9\u5e94 libc++ \u7248\u672c\u7684 libc++ \u6587\u6863 [69]\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\nlibstdc++ \u7684\n```plaintext\n-D_GLIBCXX_DEBUG\n```\n\u5b8f\u4f1a\u6539\u53d8\n```plaintext\nstd::vector\n```\n\u7b49\u6807\u51c6\u7c7b\u6a21\u677f\u7684\u5927\u5c0f\u4e0e\u884c\u4e3a\uff0c\u4ece\u800c\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u4e8c\u8fdb\u5236\u63a5\u53e3\uff08ABI\uff09\u3002\u7528\n```plaintext\n-D_GLIBCXX_DEBUG\n```\n\u7f16\u8bd1\u7684\u4ee3\u7801\u4e0e\u672a\u7528\u5b83\u7f16\u8bd1\u7684\u4ee3\u7801\uff0c\u5982\u679c\u5728\u4e24\u4e2a\u7ffb\u8bd1\u5355\u5143\u4e4b\u95f4\u4f20\u9012\u8c03\u8bd5\u6a21\u5f0f\u5bb9\u5668\u7684\u5b9e\u4f8b\uff0c\u5c31\u65e0\u6cd5\u4e92\u76f8\u94fe\u63a5\u3002libstdc++ \u7684\n```plaintext\n-D_GLIBCXX_ASSERTIONS\n```\n\u5b8f\u4e0d\u5f71\u54cd ABI\u3002\n\nlibc++ \u7684\n```plaintext\n-D_LIBCPP_HARDENING_MODE\n```\n\u5b8f\u4e0d\u5f71\u54cd ABI\u3002\u6bcf\u79cd\u6a21\u5f0f\u4f7f\u7528\u7684\u662f\u5f53\u524d ABI \u914d\u7f6e\u4e0b\u53ef\u7528\u7684\u68c0\u67e5\u5b50\u96c6\uff0c\u800c ABI \u914d\u7f6e\u7531\u5e73\u53f0\u51b3\u5b9a\u3002\u5f71\u54cd ABI \u7684\u989d\u5916 libc++ \u68c0\u67e5\u53ef\u4ee5\u5728\u6784\u5efa libc++ \u81ea\u8eab\u65f6\u9009\u62e9\u542f\u7528 [70]\u3002\n\n\u65e0\u6cd5\u63a7\u5236\u5e95\u5c42 C++ \u6807\u51c6\u5e93\u6240\u7528 ABI \u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ea\u5e94\u4f7f\u7528\u4e0d\u5f71\u54cd ABI \u7684\u524d\u7f6e\u6761\u4ef6\u68c0\u67e5\u53d8\u4f53\u3002\n\n* * *\n\n### \u542f\u7528\u4e25\u683c\u67d4\u6027\u6570\u7ec4\n\n- **`-fstrict-flex-arrays=3`**\uff08GCC 13.0.0 Clang 16.0.0\uff09\uff1a\u4ec5\u5f53\u672b\u5c3e\u6570\u7ec4\uff08\u4f4d\u4e8e\u7ed3\u6784\u4f53\u672b\u5c3e\uff09\u58f0\u660e\u4e3a `[]` \u65f6\u624d\u89c6\u4e3a\u67d4\u6027\u6570\u7ec4\u3002\n- **`-fstrict-flex-arrays=2`**\uff08GCC 13.0.0 Clang 15.0.0\uff09\uff1a\u4ec5\u5f53\u672b\u5c3e\u6570\u7ec4\u58f0\u660e\u4e3a `[]` \u6216 `[0]` \u65f6\u624d\u89c6\u4e3a\u67d4\u6027\u6570\u7ec4\u3002\n- **`-fstrict-flex-arrays=1`**\uff08GCC 13.0.0 Clang 15.0.0\uff09\uff1a\u4ec5\u5f53\u672b\u5c3e\u6570\u7ec4\u58f0\u660e\u4e3a `[]`\u3001`[0]` \u6216 `[1]` \u65f6\u624d\u89c6\u4e3a\u67d4\u6027\u6570\u7ec4\u3002\n- **`-fstrict-flex-arrays=0`**\uff08GCC 13.0.0 Clang 15.0.0\uff09\uff1a\u628a\u4efb\u4f55\u672b\u5c3e\u6570\u7ec4\uff08\u4f4d\u4e8e\u7ed3\u6784\u4f53\u672b\u5c3e\uff09\u90fd\u89c6\u4e3a\u67d4\u6027\u6570\u7ec4\uff08\u9ed8\u8ba4\uff09\u3002\n\n### \u6982\u8ff0\n\n\u6539\u53d8\u7f16\u8bd1\u5668\u5bf9\u672b\u5c3e\u6570\u7ec4\u7684\u5224\u5b9a\u3002\u7ea7\u522b\u8d8a\u9ad8\uff0c\u7f16\u8bd1\u5668\u8d8a\u4e25\u683c\u5730\u5c0a\u91cd\u672b\u5c3e\u6570\u7ec4\u7684\u58f0\u660e\u5927\u5c0f [71]\uff08\u8fd9\u4f1a\u5f71\u54cd\u8fb9\u754c\u68c0\u67e5\uff09[72]\u3002\n\n\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u5c31\n```plaintext\n_FORTIFY_SOURCE\n```\n\u6240\u4f7f\u7528\u7684\n```plaintext\n__builtin_object_size()\n```\n\u8ba1\u7b97\u800c\u8a00\uff0cGCC \u4e0e Clang \u4f1a\u628a\u6240\u6709\u672b\u5c3e\u6570\u7ec4\uff08\u4f5c\u4e3a\u7ed3\u6784\u4f53\u6700\u540e\u4e00\u4e2a\u6210\u5458\u653e\u7f6e\u7684\u6570\u7ec4\uff09\u5f53\u4f5c\u67d4\u6027\u5927\u5c0f\u6570\u7ec4\uff0c**\u4e0d\u7ba1**\u5176**\u58f0\u660e**\u5927\u5c0f\u662f\u591a\u5c11 [73]\u3002\u8fd9\u4f1a\u5173\u6389\u4e00\u4e9b\u5e76\u4e0d\u603b\u9700\u8981\u5173\u95ed\u7684\u8fb9\u754c\u68c0\u67e5\u3002\u4f8b\u5982\uff0c\u5728\u9ed8\u8ba4\u8bbe\u7f6e\u4e0b\uff0c\u7ed9\u5b9a\uff1a\n\n```\nstruct trailing_array {\n    int a;\n    int b;\n    int c[4];\n};\nstruct trailing_array *trailing;\n```\n\n```plaintext\n__builtin_object_size(trailing->c, 1)\n```\n\u7684\u503c\u662f\n```plaintext\n-1\n```\n\uff08\u201c\u5927\u5c0f\u672a\u77e5\u201d\uff09\uff0c\u4ece\u800c\u6291\u5236\u4e86\u8fb9\u754c\u68c0\u67e5\u3002\u8fd9\u79cd\u9ed8\u8ba4\u884c\u4e3a\u7684\u539f\u56e0\u662f\u8981\u517c\u5bb9\u201cstruct hack\u201d\u60ef\u7528\u6cd5\uff0c\u5373\u5141\u8bb8\u628a\u672b\u5c3e\u6570\u7ec4\u5f53\u4f5c\u53ef\u53d8\u5927\u5c0f\u5904\u7406\uff08\u4e0d\u8bba\u5176\u58f0\u660e\u5927\u5c0f\uff09[72]\u3002\n\n```plaintext\n-fstrict-flex-arrays\n```\n\u9009\u9879\u8ba9\u7f16\u8bd1\u5668\u66f4\u4e25\u683c\u5730\u5c0a\u91cd\u672b\u5c3e\u6570\u7ec4\u6210\u5458\u7684\u5927\u5c0f\u3002\u8fd9\u4f7f\u5f97\n```plaintext\n_FORTIFY_SOURCE\n```\n\u6216\n```plaintext\n-fsanitize=bounds\n```\n[74] \u4e4b\u7c7b\u63d2\u6869\u6240\u6dfb\u52a0\u7684\u8fb9\u754c\u68c0\u67e5\u80fd\u591f\u6b63\u786e\u5224\u5b9a\u672b\u5c3e\u6570\u7ec4\u7684\u5927\u5c0f\u3002\n\n\u4ee3\u4ef7\u662f\uff0c\u4f9d\u8d56\u201cstruct hack\u201d\u6765\u5b9e\u73b0\u4efb\u610f\u5927\u5c0f\u672b\u5c3e\u6570\u7ec4\u7684\u4ee3\u7801\u53ef\u80fd\u56e0\u6b64\u5931\u6548 [75]\u3002\u8fd9\u7c7b\u4ee3\u7801\u53ef\u80fd\u9700\u8981\u4fee\u6539\uff0c\u4ee5\u660e\u786e\u58f0\u660e\u5b83\u6ca1\u6709\u7279\u5b9a\u8fb9\u754c\u3002\n\nC99 \u7684\u67d4\u6027\u6570\u7ec4\u5199\u6cd5\n```plaintext\n[]\n```\n\u662f\u6807\u51c6\u5316\u7684\u8868\u8fbe\u201c\u6570\u7ec4\u8fb9\u754c\u672a\u660e\u786e\u6307\u5b9a\u201d\u7684\u65b9\u5f0f\u3002\u7136\u800c\u6709\u4e9b\u4ee3\u7801\u5e93\u4f7f\u7528 GCC \u7684\u96f6\u957f\u5ea6\u6570\u7ec4\u6269\u5c55\n```plaintext\n[0]\n```\n\uff0c\u8fd8\u6709\u4e9b\u4ee3\u7801\u5e93\u7528\u957f\u5ea6\u4e3a 1 \u7684\u6570\u7ec4\n```plaintext\n[1]\n```\n\u6765\u6307\u793a\u67d4\u6027\u6570\u7ec4\u6210\u5458\u3002\u63d0\u4f9b\u9009\u9879\u503c\n```plaintext\n1\n```\n\u4e0e\n```plaintext\n2\n```\n\uff0c\u662f\u4e3a\u4e86\u8ba9\u4f7f\u7528\n```plaintext\n[0]\n```\n\u548c\n```plaintext\n[1]\n```\n\u8868\u8fbe\u6b64\u7c7b\u8bed\u4e49\u7684\u7a0b\u5e8f\u5728\u4e0d\u4fee\u6539\u6e90\u7801\u7684\u524d\u63d0\u4e0b\u4e5f\u80fd\u83b7\u5f97\u4e00\u4e9b\u8fb9\u754c\u68c0\u67e5 [76]\u3002\n\n\u672c\u6307\u5357\u5efa\u8bae\u4f7f\u7528\u6807\u51c6\u7684 C99 \u67d4\u6027\u6570\u7ec4\u5199\u6cd5\n```plaintext\n[]\n```\n\uff0c\u800c\u4e0d\u662f\u975e\u6807\u51c6\u7684\n```plaintext\n[0]\n```\n\u6216\u5bb9\u6613\u8bef\u5bfc\u7684\n```plaintext\n[1]\n```\n\uff0c\u7136\u540e\u914d\u5408\n```plaintext\n-fstrict-flex-arrays=3\n```\n\u6765\u6539\u5584\u6b64\u7c7b\u60c5\u5f62\u4e0b\u7684\u8fb9\u754c\u68c0\u67e5\u3002\u8fd9\u6837\u4e00\u6765\uff0c\u7528\n```plaintext\n[0]\n```\n\u8868\u793a\u67d4\u6027\u6570\u7ec4\u7684\u4ee3\u7801\u9700\u8981\u6539\u4e3a\n```plaintext\n[]\n```\n\u3002\u7528\n```plaintext\n[1]\n```\n\u8868\u793a\u67d4\u6027\u6570\u7ec4\u7684\u4ee3\u7801\u4e0d\u4ec5\u9700\u8981\u6539\u4e3a\n```plaintext\n[]\n```\n\uff0c\u8fd8\u9700\u8981\u5927\u91cf\u4fee\u6539\u4ee5\u6d88\u9664\u5dee\u4e00\uff08off-by-one\uff09\u9519\u8bef\u3002\u4f7f\u7528\n```plaintext\n[1]\n```\n\u4e0d\u53ea\u662f\u8bef\u5bfc [77]\uff0c\u8fd8\u5bb9\u6613\u51fa\u9519\uff1b\u8981\u6ce8\u610f**\u73b0\u6709**\u7528\n```plaintext\n[1]\n```\n\u8868\u793a\u67d4\u6027\u6570\u7ec4\u7684\u4ee3\u7801**\u76ee\u524d**\u53ef\u80fd\u5c31\u5b58\u5728\u5dee\u4e00\u9519\u8bef [78]\u3002\n\n\u4e00\u65e6\u843d\u5b9e\uff0c\u58f0\u660e\u4e3a\u56fa\u5b9a\u5927\u5c0f\u7684\u7ed3\u6784\u4f53\u672b\u5c3e\u6570\u7ec4\u4e5f\u80fd\u63a5\u53d7\u8fb9\u754c\u68c0\u67e5\u3002\u6b64\u5916\uff0c\u6e90\u7801\u4ee5\u6807\u51c6\u65b9\u5f0f\u6beb\u4e0d\u542b\u7cca\u5730\u8868\u660e\u4e86\u54ea\u4e9b\u5730\u65b9\u5728\u4f7f\u7528\u67d4\u6027\u6570\u7ec4\u3002\u8fd9\u4e2a\u9009\u9879\u901a\u5e38\u6ca1\u6709\u663e\u8457\u7684\u6027\u80fd\u4ee3\u4ef7\uff08\u5728\u5b8c\u6210\u5fc5\u8981\u4fee\u6539\u4e4b\u540e\uff09\u3002\n\n* * *\n\n### \u542f\u7528\u53ef\u53d8\u5927\u5c0f\u6808\u5206\u914d\u6709\u6548\u6027\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\n\n- **`-fstack-clash-protection`**\uff08GCC 8.0.0 Clang 11.0.0\uff09\uff1a\u542f\u7528\u53ef\u53d8\u5927\u5c0f\u6808\u5206\u914d\u6709\u6548\u6027\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\n- **`-param stack-clash-protection-guard-size=`** _`<gap size>`_\uff08GCC 8.0.0 Clang 11.0.0\uff09\uff1a\u8bbe\u7f6e\u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\uff0c\u7528\u4e8e\u786e\u5b9a\u63d2\u6869\u4ee3\u7801\u7684\u63a2\u6d4b\u7c92\u5ea6\u3002\n\n### \u6982\u8ff0\n\n\u6808\u51b2\u7a81\uff08stack clash\uff09\u4fdd\u62a4\u7528\u4e8e\u7f13\u89e3\u8bd5\u56fe\u7ed5\u8fc7\u64cd\u4f5c\u7cfb\u7edf**\u6808\u4fdd\u62a4\u95f4\u9699**\uff08stack guard gap\uff09\u7684\u653b\u51fb\u3002\u6808\u4fdd\u62a4\u95f4\u9699\u662f Linux \u5185\u6838\u7684\u4e00\u9879\u5b89\u5168\u7279\u6027\uff0c\u4fdd\u62a4\u8fdb\u7a0b\u514d\u53d7\u987a\u5e8f\u6808\u6ea2\u51fa\u4e4b\u5bb3\u2014\u2014\u8fd9\u7c7b\u6ea2\u51fa\u4e00\u8def\u6da8\u8fc7\u6808\uff0c\u4ee5\u7834\u574f\u76f8\u90bb\u7684\u5185\u5b58\u533a\u57df\u3002\n\n\u4e3a\u907f\u514d\u6808\u4fdd\u62a4\u95f4\u9699\u88ab\u7ed5\u8fc7\uff0c\u6808\u4e0a\u6bcf\u4e00\u6b21\u65b0\u7684\u5206\u914d\u90fd\u9700\u8981\u63a2\u6d4b\u65b0\u5206\u914d\u7684\u5185\u5b58\uff0c\u770b\u662f\u5426\u89e6\u53ca\u6808\u4fdd\u62a4\u95f4\u9699\u3002\u6808\u51b2\u7a81\u4fdd\u62a4\u786e\u4fdd\u5355\u6b21\u5206\u914d\u4e0d\u5f97\u5927\u4e8e\u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\uff0c\u7f16\u8bd1\u5668\u4f1a\u628a\u8f83\u5927\u7684\u5206\u914d\u8f6c\u6362\u4e3a\u4e00\u7cfb\u5217\u8f83\u5c0f\u7684\u5b50\u5206\u914d\u3002\u6b64\u5916\uff0c\u5b83\u8fd8\u786e\u4fdd\u4efb\u4f55\u4e00\u4e32\u5b50\u5206\u914d\u5728\u672a\u8fdb\u884c\u63d2\u5165\u63a2\u6d4b\u7684\u60c5\u51b5\u4e0b\u4e0d\u80fd\u8d8a\u8fc7\u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\u3002\n\n\u63a2\u6d4b\u6307\u4ee4\u53ef\u4ee5\u662f\u9690\u5f0f\u7684\uff0c\u4e5f\u53ef\u4ee5\u662f\u663e\u5f0f\u7684\u3002\u9690\u5f0f\u63a2\u6d4b\u81ea\u7136\u5730\u51fa\u73b0\u5728\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u4e2d\uff0c\u4f8b\u5982 x86 \u4e0e x86_64 \u7684 call \u6307\u4ee4\u628a\u8fd4\u56de\u5730\u5740\u538b\u5165\u6808\u65f6\u3002\u9690\u5f0f\u63a2\u6d4b\u4e0d\u5e26\u6765\u989d\u5916\u6027\u80fd\u5f00\u9500\u3002\u663e\u5f0f\u63a2\u6d4b\u5219\u7531\u7f16\u8bd1\u5668\u989d\u5916\u751f\u6210\u63a2\u6d4b\u6307\u4ee4\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u5982\u679c\u51fd\u6570\u6bcf\u6b21\u6700\u591a\u53ea\u5206\u914d\u76f8\u5f53\u4e8e\u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\u7684\u6808\u7a7a\u95f4\uff0c\u8fd9\u7c7b\u5e94\u7528\u7a0b\u5e8f\u4e0d\u4f1a\u56e0\u6808\u51b2\u7a81\u4fdd\u62a4\u800c\u51fa\u73b0\u4e0d\u5229\u7684\u6027\u80fd\u5f71\u54cd\u3002\n\n\u7136\u800c\uff0c\u5bf9\u4e8e\u6267\u884c\u8d85\u8fc7\u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\u7684\u5927\u989d\u5206\u914d\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u6808\u51b2\u7a81\u4fdd\u62a4\u53ef\u80fd\u5bfc\u81f4\u6027\u80fd\u9000\u5316\u3002\u6027\u80fd\u5f71\u54cd\u968f\u5927\u989d\u5206\u914d\u7684\u5927\u5c0f\u548c\u6240\u9700\u663e\u5f0f\u63a2\u6d4b\u7684\u6570\u91cf\u800c\u589e\u957f\u3002\u53ef\u4ee5\u901a\u8fc7\u589e\u5927\u7531\n```plaintext\nvm.heap-stack-gap\n```\nsysctl \u53c2\u6570\u63a7\u5236\u7684 Linux \u6808\u4fdd\u62a4\u95f4\u9699\u5927\u5c0f\uff0c\u5e76\u7528\u5bf9\u5e94\u7684\n```plaintext\n-param stack-clash-protection-guard-size\n```\n\u7f16\u8bd1\u5e94\u7528\u7a0b\u5e8f\uff0c\u6765\u7f13\u89e3\u6027\u80fd\u9000\u5316\u3002\u8f83\u5927\u7684\u503c\u4f1a\u51cf\u5c11\u663e\u5f0f\u63a2\u6d4b\u7684\u6570\u91cf\uff0c\u4f46\u82e5\u8be5\u503c\u5927\u4e8e\u5185\u6838\u7684\u95f4\u9699\u503c\uff0c\u4ee3\u7801\u5c31\u4f1a\u66b4\u9732\u5728\u6808\u51b2\u7a81\u7c7b\u653b\u51fb\u4e4b\u4e0b\u3002\n\n\u8bf7\u6ce8\u610f\uff0c\n```plaintext\nvm.heap-stack-gap\n```\n\u4ee5\u9875\u5927\u5c0f\u7684\u500d\u6570\u8868\u793a\u95f4\u9699\uff0c\u800c\n```plaintext\nstack-clash-protection-guard-size\n```\n\u4ee5\u5b57\u8282\u7684 2 \u7684\u5e42\u8868\u793a\u3002\u56e0\u6b64\u5728 x86 \u4e0a\n```plaintext\nvm.heap-stack-gap=256\n```\n\uff08256 * 4KiB = 1MiB \u95f4\u9699\uff09\u5bf9\u5e94\u7684\n```plaintext\nstack-clash-protection-guard-size\n```\n\u662f 20\uff082^20 = 1MiB \u95f4\u9699\uff09\u3002\n\n* * *\n\n### \u542f\u7528\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\n\n- **`-fstack-protector-strong`**\uff08GCC 4.9.0 Clang 6.0.0\uff09\uff1a\u4f7f\u7528\u5f3a\u542f\u53d1\u5f0f\u542f\u7528\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\n- **`-fstack-protector-all`**\uff08GCC 4.1.2 Clang 6.0.0\uff09\uff1a\u5bf9\u6240\u6709\u51fd\u6570\u542f\u7528\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\n- **`-fstack-protector --param=ssp-buffer-size=`** _`<n>`_\uff08GCC 4.1.2 Clang 6.0.0\uff09\uff1a\u5bf9\u5b57\u7b26\u6570\u7ec4\u957f\u5ea6\u4e0d\u5c0f\u4e8e _n_ \u5b57\u8282\u7684\u51fd\u6570\u542f\u7528\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\n\n### \u6982\u8ff0\n\n\u6808\u4fdd\u62a4\uff08stack protector\uff09\u5bf9\u7f16\u8bd1\u5668\u751f\u6210\u7684\u4ee3\u7801\u505a\u63d2\u6869\uff0c\u4ee5\u4fbf\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u7a0b\u5e8f\u6808\u4e0a\u5df2\u5206\u914d\u7f13\u51b2\u533a\u4e2d\u7684\u6ea2\u51fa\uff08\u4fd7\u79f0\u201c\u6808\u7c89\u788e\u201d\uff0cstack smashing\uff09\u3002\n\n\u68c0\u6d4b\u65b9\u5f0f\u662f\u5728\u51fd\u6570\u5e8f\u8a00\u4e2d\u5411\u6808\u5e27\u63d2\u5165\u4e00\u4e2a**\u91d1\u4e1d\u96c0**\uff08canary\uff09\u503c\u3002\u5728\u51fd\u6570\u6536\u5c3e\u65f6\u628a\u8be5\u91d1\u4e1d\u96c0\u4e0e\u53c2\u8003\u503c\u6bd4\u5bf9\uff0c\u82e5\u4e0d\u4e00\u81f4\uff0c\u8fd0\u884c\u65f6\u4fbf\u8c03\u7528\n```plaintext\n__stack_chk_fail()\n```\n\uff0c\u7ec8\u6b62\u51fa\u9519\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\n\n\u8fd9\u53ef\u4ee5\u7f13\u89e3\u6f5c\u5728\u7684\u63a7\u5236\u6d41\u52ab\u6301\u653b\u51fb\u2014\u2014\u8fd9\u7c7b\u653b\u51fb\u901a\u8fc7\u7834\u574f\u6808\u4e0a\u4fdd\u5b58\u7684\u8fd4\u56de\u5730\u5740\u6765\u8fbe\u5230\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\n\n\u8fc7\u65f6\u7684 GCC \u7248\u672c\u5728\u4e3a 64 \u4f4d Arm\uff08AArch64\uff09\u5904\u7406\u5668\u7f16\u8bd1\u65f6\uff0c\u53ef\u80fd\u65e0\u6cd5\u68c0\u6d4b\u6216\u9632\u5fa1\u52a8\u6001\u5927\u5c0f\u5c40\u90e8\u53d8\u91cf\uff08\u4f8b\u5982\u53d8\u957f\u6570\u7ec4\uff0c\u6216\u7528\n```plaintext\nalloca()\n```\n\u5206\u914d\u7684\u7f13\u51b2\u533a\uff09\u7684\u6ea2\u51fa [79]\u3002\u4f7f\u7528\u57fa\u4e8e GCC \u5de5\u5177\u94fe\u7684 AArch64 \u7528\u6237\u5e94\u786e\u4fdd\u4f7f\u7528 GCC 7 \u6216\u66f4\u9ad8\u7248\u672c\u7684\u8f83\u65b0\u7248\u672c\uff0c\u8fd9\u4e9b\u7248\u672c\u652f\u6301\u4e00\u79cd\u66ff\u4ee3\u7684\u6808\u5e27\u5e03\u5c40\uff1a\u628a\u6240\u6709\u5c40\u90e8\u53d8\u91cf\u653e\u5728\u4fdd\u5b58\u7684\u5bc4\u5b58\u5668\u4e4b\u4e0b\uff0c\u6808\u4fdd\u62a4\u91d1\u4e1d\u96c0\u5939\u5728\u4e24\u8005\u4e4b\u95f4 [80]\u3002\n\n\u67d0\u4e9b\u7248\u672c\u7684 GCC [81] \u5728\u4e3a 64 \u4f4d Arm\uff08AArch64\uff09\u5904\u7406\u5668\u7f16\u8bd1\u65f6\uff0c\u53ef\u80fd\u65e0\u6cd5\u68c0\u6d4b\u6216\u9632\u5fa1\u52a8\u6001\u5927\u5c0f\u5c40\u90e8\u53d8\u91cf\uff08\u4f8b\u5982\u53d8\u957f\u6570\u7ec4\uff0c\u6216\u7528 alloca() \u5206\u914d\u7684\u7f13\u51b2\u533a\uff09\u7684\u6ea2\u51fa [79]\u3002\u57fa\u4e8e GCC \u5de5\u5177\u94fe\u7684 AArch64 \u7528\u6237\u5e94\u4e8b\u5148\u786e\u8ba4\u5176\u662f\u5426\u652f\u6301\u4e00\u79cd\u66ff\u4ee3\u7684\u6808\u5e27\u5e03\u5c40\uff1a\u628a\u6240\u6709\u5c40\u90e8\u53d8\u91cf\u653e\u5728\u4fdd\u5b58\u7684\u5bc4\u5b58\u5668\u4e4b\u4e0b\uff0c\u6808\u4fdd\u62a4\u91d1\u4e1d\u96c0\u5939\u5728\u4e24\u8005\u4e4b\u95f4 [80]\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u6808\u4fdd\u62a4\u652f\u6301\u4e09\u79cd\u4e0d\u540c\u7684\u542f\u53d1\u5f0f\uff0c\u7528\u4e8e\u5728\u7f16\u8bd1\u671f\u51b3\u5b9a\u54ea\u4e9b\u51fd\u6570\u88ab\u63d2\u6869\u4ee5\u505a\u8fd0\u884c\u65f6\u68c0\u67e5\uff1a\n\n*   **`-fstack-protector-strong`** [82]\uff1a\u5bf9\u6ee1\u8db3\u4ee5\u4e0b\u4efb\u4e00\u6761\u4ef6\u7684\u51fd\u6570\u63d2\u6869\n    *   \u5728\u8d4b\u503c\u8bed\u53e5\u53f3\u4fa7\u3001\u6216\u4f5c\u4e3a\u51fd\u6570\u5b9e\u53c2\u65f6\u53d6\u5176\u4efb\u4e00\u5c40\u90e8\u53d8\u91cf\u7684\u5730\u5740\n    *   \u5206\u914d\u4e86\u5c40\u90e8\u6570\u7ec4\uff0c\u4e0d\u8bba\u7c7b\u578b\u6216\u957f\u5ea6\n    *   \u5206\u914d\u4e86\u5305\u542b\u6570\u7ec4\u7684\u5c40\u90e8\u7ed3\u6784\u4f53\u6216\u8054\u5408\u4f53\uff0c\u4e0d\u8bba\u8be5\u6570\u7ec4\u7684\u7c7b\u578b\u6216\u957f\u5ea6\n    *   \u6709\u663e\u5f0f\u7684\u5c40\u90e8\u5bc4\u5b58\u5668\u53d8\u91cf\n\n*   `-fstack-protector`\uff1a\u5bf9\u8c03\u7528\u4e86 alloca()\u3001\u6216\u5206\u914d\u7684\u5b57\u7b26\u6570\u7ec4\u957f\u5ea6\u4e0d\u5c0f\u4e8e n \u5b57\u8282\u7684\u51fd\u6570\u63d2\u6869\u3002\u63d2\u6869\u9608\u503c\u53ef\u901a\u8fc7 `--param=ssp-buffer-size=` _`n`_ \u9009\u9879\u8c03\u6574\uff08\u9ed8\u8ba4\uff1a8 \u5b57\u8282\uff09\u3002\n*   `-fstack-protector-all`\uff1a\u5bf9\u6240\u6709\u51fd\u6570\u63d2\u6869\u3002\n\n\u6027\u80fd\u5f00\u9500\u53d6\u51b3\u4e8e\u88ab\u63d2\u6869\u51fd\u6570\u7684\u6570\u91cf\uff0c\u4ee5\u53ca\u88ab\u63d2\u6869\u51fd\u6570\u5728\u8fd0\u884c\u65f6\u7684\u6fc0\u6d3b\u9891\u7387\u3002\u63a8\u8350\u542f\u7528\n```plaintext\n-fstack-protector-strong\n```\n\uff0c\u56e0\u4e3a\u5b83\u5728\u51fd\u6570\u8986\u76d6\u8303\u56f4\u4e0e\u6027\u80fd\u4e4b\u95f4\u53d6\u5f97\u4e86\u826f\u597d\u5e73\u8861\u3002\u4f7f\u7528\u8f83\u8001\u7f16\u8bd1\u5668\u7248\u672c\u7684\u9879\u76ee\u53ef\u4ee5\u8003\u8651\n```plaintext\n-fstack-protector-all\n```\n\uff0c\u6216\u914d\u5408\u66f4\u4e25\u683c\u9608\u503c\u7684\n```plaintext\n-fstack-protector\n```\n\uff0c\u4f8b\u5982\n```plaintext\n--param=ssp-buffer-size=4\n```\n\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n```plaintext\n-fstack-protector-strong\n```\n\u63a8\u8350\u7528\u4e8e\u6240\u6709\u5177\u6709\u5e38\u89c4\u6808\u884c\u4e3a\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\u5e26\u6709\u624b\u5199\u6c47\u7f16\u4f18\u5316\u3001\u5e76\u5bf9\u6808\u5e03\u5c40\u505a\u4e86\u5047\u5b9a\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u53ef\u80fd\u4e0e\u6808\u4fdd\u62a4\u529f\u80fd\u4e0d\u517c\u5bb9\u3002\n\n* * *\n\n### \u542f\u7528\u63a7\u5236\u6d41\u4e0e\u5206\u652f\u4fdd\u62a4\uff0c\u62b5\u5fa1\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\u4e0e\u9762\u5411\u8df3\u8f6c\u7f16\u7a0b\u653b\u51fb\n\n- **`-fcf-protection=full`**\uff08GCC 8.0.0\u3001Clang 7.0.0\uff09\uff1a\u5728 x86_64 \u4e0a\u542f\u7528\u63a7\u5236\u6d41\u4fdd\u62a4\uff0c\u62b5\u5fa1\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff08ROP\uff09\u4e0e\u9762\u5411\u8df3\u8f6c\u7f16\u7a0b\uff08JOP\uff09\u653b\u51fb\u3002\n- **`-fcf-protection=branch`**\uff08GCC 8.0.0\u3001Clang 7.0.0\uff09\uff1a\u5728 x86_64 \u4e0a\u542f\u7528\u63a7\u5236\u6d41\u4fdd\u62a4\uff0c\u62b5\u5fa1 JOP\u3002\n- **`-fcf-protection=return`**\uff08GCC 8.0.0\u3001Clang 7.0.0\uff09\uff1a\u5728 x86_64 \u4e0a\u542f\u7528\u63a7\u5236\u6d41\u4fdd\u62a4\uff0c\u62b5\u5fa1 ROP\u3002\n- **`-fcf-protection=none`**\uff08GCC 8.0.0\u3001Clang 7.0.0\uff09\uff1a\u5173\u95ed\u63a7\u5236\u6d41\u4fdd\u62a4\u3002\n- **`-fcf-protection=check`**\uff08GCC 8.0.0\uff09\uff1a\u6307\u793a\u94fe\u63a5\u5668\u6821\u9a8c\u6700\u7ec8\u94fe\u63a5\uff08\u5e26\u94fe\u63a5\u65f6\u4f18\u5316\uff0cLTO\uff09\u4e2d\u7684\u6240\u6709\u76ee\u6807\u6587\u4ef6\u662f\u5426\u4ee5\u76f8\u540c\u7684\u63a7\u5236\u6d41\u4fdd\u62a4\u7f16\u8bd1\u3002\n- **`-mbranch-protection=standard`**\uff08GCC 9.0.0\u3001Clang 8.0.0\uff09\uff1a\u5728 AArch64 \u4e0a\u542f\u7528\u5206\u652f\u4fdd\u62a4\u4ee5\u5bf9\u6297 ROP \u4e0e JOP \u653b\u51fb\u3002\n\n### \u6982\u8ff0\n\n\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff08ROP\uff09\u5229\u7528\u6700\u521d\u7684\u7834\u574f\uff08\u4f8b\u5982\u7f13\u51b2\u533a\u6ea2\u51fa\uff09\u6267\u884c\u4e00\u6b21\u95f4\u63a5\u8df3\u8f6c\uff0c\u4ece\u800c\u6267\u884c\u53e6\u4e00\u6bb5\u4e0d\u540c\u7684\u6307\u4ee4\u5e8f\u5217\u3002\u8fd9\u5f80\u5f80\u662f\u5bf9\u65e2\u6709\u4ee3\u7801\u7684\u8bef\u7528\uff0c\u56e0\u6b64\u5e38\u88ab\u79f0\u4e3a\u201c\u4ee3\u7801\u590d\u7528\u653b\u51fb\u201d\u3002\u4e00\u79cd\u5bf9\u7b56\u662f\u786e\u4fdd\u8fd4\u56de\u5730\u5740\u6b63\u786e\u3001\u4e14\u8df3\u8f6c\u5730\u5740\u6307\u5411\u95f4\u63a5\u8c03\u7528\u6216\u5206\u652f\u7684\u5df2\u77e5\u76ee\u6807\u3002\u8fd9\u4e0d\u662f\u5b8c\u6574\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u4f46\u80fd\u8ba9\u653b\u51fb\u66f4\u96be\u5b9e\u65bd\u3002\n\n\u81ea GCC 14 \u8d77\uff0c\u8981\u4e3a x86_64 \u67b6\u6784\u6539\u53d8\u9ed8\u8ba4\u7684\u63a7\u5236\u6d41\u4fdd\u62a4\u503c\uff08\n```plaintext\nfull\n```\n\uff0c\u7b49\u4ef7\u4e8e\n```plaintext\nbranch\n```\n\u52a0\n```plaintext\nreturn\n```\n\uff09\uff0c\u9700\u8981\u5148\u4f20\n```plaintext\n-fcf-protection=none\n```\n\uff0c\u518d\u4f20\u6240\u9700\u7684\n```plaintext\n-fcf-protection\n```\n\u9009\u9879\uff0c\u4f8b\u5982\n```plaintext\n-fcf-protection=none -fcf-protection=branch\n```\n\u6216\n```plaintext\n-fcf-protection=none -fcf-protection=return\n```\n[83]\u3002\n\n```plaintext\n-fcf-protection=check\n```\n\u5728\u7f16\u8bd1\u671f\u88ab\u5ffd\u7565\uff0c\u4f46\u5b83\u6307\u793a\u94fe\u63a5\u5668\u6821\u9a8c\u6700\u7ec8\u94fe\u63a5\uff08\u5e26\u94fe\u63a5\u65f6\u4f18\u5316\uff0cLTO\uff09\u4e2d\u7684\u6240\u6709\u76ee\u6807\u6587\u4ef6\u662f\u5426\u4ee5\u76f8\u540c\u7684\u63a7\u5236\u6d41\u4fdd\u62a4\u7f16\u8bd1\u3002\u6df7\u7528\u63a7\u5236\u6d41\u4fdd\u62a4\u4e0d\u540c\u7684\u76ee\u6807\u6587\u4ef6\u53ef\u80fd\u5bfc\u81f4\u8fd0\u884c\u65f6\u6545\u969c\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u6709\u6027\u80fd\u5f71\u54cd\uff0c\u4f46\u7531\u4e8e\u6709\u786c\u4ef6\u8f85\u52a9\uff0c\u901a\u5e38\u8f83\u8f7b\u5fae\u3002\n```plaintext\n-fcf-protection=full\n```\n\u9009\u9879\u542f\u7528 Intel \u7684\u63a7\u5236\u6d41\u5f3a\u5236\u6280\u672f\uff08CET\uff09[84]\uff0c\u5b83\u5f15\u5165\u5f71\u5b50\u6808\uff08SHSTK\uff09\u4e0e\u95f4\u63a5\u5206\u652f\u8ddf\u8e2a\uff08IBT\uff09\u3002\n\n```plaintext\n-mbranch-protection=standard\n```\n\u9009\u9879\u5728 AArch64 \u4e0a\u542f\u7528\u7c7b\u4f3c\u7684\u4fdd\u62a4\u3002\u5728 clang \u4e2d\uff0c\n```plaintext\n-mbranch-protection=standard\n```\n\u7b49\u4ef7\u4e8e\n```plaintext\n-mbranch-protection=bti+pac-ret\n```\n\uff0c\u5373\u542f\u7528 AArch64 \u7684\u5206\u652f\u76ee\u6807\u8bc6\u522b\uff08BTI\uff09\u4ee5\u53ca\u4f7f\u7528\u5bc6\u94a5 A \u7684\u6307\u9488\u8ba4\u8bc1\uff08pac-ret\uff09[85]\u3002\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u89c6\u76ee\u6807\u5e73\u53f0\u800c\u5b9a\uff0c\u7f16\u8bd1\u5668\u53ef\u80fd\u4e3a AArch64 \u7684 PAC \u4e0e BTI \u751f\u6210\u63d0\u793a\u7a7a\u95f4\uff08hint-space\uff09\u6307\u4ee4 [86]\u3002\u8fd9\u4e9b\u63d0\u793a\u6307\u4ee4\u5141\u8bb8\u4e8c\u8fdb\u5236\u6587\u4ef6\u5728\u4e0d\u652f\u6301\u5e95\u5c42\u786c\u4ef6\u7279\u6027\u7684\u673a\u5668\u4e0a\u8fd0\u884c\u3002\u7136\u800c\u5b83\u4eec\u6709\u65f6\u6548\u7387\u8f83\u4f4e\uff0c\u800c\u4e14\u5728\u7f3a\u5c11\u786c\u4ef6\u652f\u6301\u65f6\uff0c\u9884\u671f\u7684\u5206\u652f\u4fdd\u62a4\u5e76\u4e0d\u4f1a\u771f\u6b63\u751f\u6548\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\nIntel CET \u5f71\u5b50\u6808\u9700\u8981 Linux \u5185\u6838 6.6 \u6216\u66f4\u9ad8\u7248\u672c\uff0c\u4ee5\u53ca glibc 2.39 \u6216\u66f4\u9ad8\u7248\u672c\u3002\u6b64\u5916\uff0c\u8fd8\u5fc5\u987b\u5728\u8fd0\u884c\u65f6\u901a\u8fc7\n```plaintext\nGLIBC_TUNABLES\n```\n\u73af\u5883\u53d8\u91cf\u4e3a glibc \u5f00\u542f\u5bf9\u5e94\u7684\u786c\u4ef6\u80fd\u529b\u53ef\u8c03\u9879\uff0c\u624d\u80fd\u542f\u7528\u5f71\u5b50\u6808\u652f\u6301 [87]\uff1a\n\n```plaintext\nexport GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK\n```\n\nAArch64 \u7684 BTI \u4e0e PAC \u53ea\u80fd\u5728\u63d0\u4f9b\u8fd9\u4e9b\u67b6\u6784\u7279\u6027\u7684\u5e73\u53f0\u4e0a\u4f7f\u7528\u3002\u5177\u4f53\u6765\u8bf4\uff0cPAC \u9700\u8981\u57fa\u4e8e Arm v8.3-A \u6216\u66f4\u65b0\u7248\u672c\u7684 CPU\uff0cBTI \u9700\u8981\u57fa\u4e8e Arm v8.5-A \u6216\u66f4\u65b0\u7248\u672c\u7684 CPU\u3002\u5bf9\u4e8e\u7528\u6237\u6001\u5e94\u7528\u7a0b\u5e8f\u2014\u2014\u5c24\u5176\u662f\u5728 GNU/Linux \u73af\u5883\u4e2d\uff0c\u6b63\u5982\u8868 1 \u4e0e\u8868 2 \u6240\u63a8\u8350\u2014\u2014\u64cd\u4f5c\u7cfb\u7edf\u8d77\u7740\u5173\u952e\u4f5c\u7528\u3002\u5728\u73b0\u4ee3 Linux \u7cfb\u7edf\u4e0a\uff08\u901a\u5e38\u662f Linux \u5185\u6838 5.8 \u6216\u66f4\u9ad8\u7248\u672c\uff09\uff0c\u82e5\u786c\u4ef6\u63d0\u4f9b\u8be5\u7279\u6027\uff0cPAC \u4e0e BTI \u652f\u6301\u9ed8\u8ba4\u5f00\u542f\u3002\n\n### \u51fd\u6570\u8fd4\u56de\u65f6\u5c06\u4f7f\u7528\u8fc7\u7684\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u4ee5\u7f29\u77ed\u5bc4\u5b58\u5668\u4e2d\u6570\u636e\u7684\u751f\u547d\u5468\u671f\u5e76\u51cf\u5c11 ROP gadget\n\n- **`-fzero-call-used-regs=used-gpr`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u51fd\u6570\u4f7f\u7528\u8fc7\u7684\u901a\u7528\u5bc4\u5b58\u5668\u6e05\u96f6\u3002\n- **`-fzero-call-used-regs=used-gpr-arg`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u51fd\u6570\u7528\u4e8e\u4f20\u9012\u53c2\u6570\u7684\u901a\u7528\u5bc4\u5b58\u5668\u6e05\u96f6\u3002\n- **`-fzero-call-used-regs=used-arg`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u51fd\u6570\u7528\u4e8e\u4f20\u9012\u53c2\u6570\u7684\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u5305\u62ec\u975e\u901a\u7528\u5bc4\u5b58\u5668\u3002\n- **`-fzero-call-used-regs=used`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u51fd\u6570\u4f7f\u7528\u8fc7\u7684\u5168\u90e8\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u5305\u62ec\u975e\u901a\u7528\u5bc4\u5b58\u5668\u3002\n- **`-fzero-call-used-regs=all-gpr`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u901a\u7528\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u4e0d\u8bba\u51fd\u6570\u662f\u5426\u4f7f\u7528\u8fc7\u5b83\u4eec\u3002\n- **`-fzero-call-used-regs=all-gpr-arg`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u6240\u6709\u53ef\u7528\u4e8e\u4f20\u9012\u53c2\u6570\u7684\u901a\u7528\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u4e0d\u8bba\u51fd\u6570\u662f\u5426\u4f7f\u7528\u8fc7\u5b83\u4eec\u3002\n- **`-fzero-call-used-regs=all-arg`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u6240\u6709\u53ef\u7528\u4e8e\u4f20\u9012\u53c2\u6570\u7684\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u4e0d\u8bba\u51fd\u6570\u662f\u5426\u4f7f\u7528\u8fc7\u5b83\u4eec\u3002\n- **`-fzero-call-used-regs=all`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u5728\u8fd4\u56de\u65f6\u5c06\u6240\u6709\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u4e0d\u8bba\u51fd\u6570\u662f\u5426\u4f7f\u7528\u8fc7\u5b83\u4eec\u3002\n- **`-fzero-call-used-regs=skip`**\uff08GCC 11.0.0\u3001Clang 16.0.0\uff09\uff1a\u4e0d\u6e05\u96f6\u4efb\u4f55\u5bc4\u5b58\u5668\uff08\u9ed8\u8ba4\u503c\uff09\u3002\n\n### \u6982\u8ff0\n\n\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\uff08call-used registers\uff0c\u4e5f\u79f0 caller-saved \u6216 scratch \u5bc4\u5b58\u5668\uff09\u5728\u51fd\u6570\u8fd4\u56de\u7ed9\u8c03\u7528\u8005\u65f6\uff0c\u53ef\u80fd\u4ecd\u6301\u6709\u6d3b\u8dc3\u6570\u636e\u2014\u2014\u6307\u9488\u3001\u5bc6\u94a5\u6216\u4e2d\u95f4\u503c\u3002\n```plaintext\n-fzero-call-used-regs\n```\n\u8ba9\u7f16\u8bd1\u5668\u5728\u51fd\u6570\u6536\u5c3e\u65f6\u628a\u9009\u5b9a\u7684\u4e00\u7ec4\u5bc4\u5b58\u5668\u6e05\u96f6 [88]\u3002\n\n\u8fd9\u6709\u4e24\u4e2a\u4e0d\u540c\u7684\u4f5c\u7528\u3002\u5176\u4e00\u662f\u7f29\u77ed\u5bc4\u5b58\u5668\u4e2d\u6240\u6301\u6570\u636e\u7684\u751f\u547d\u5468\u671f\uff0c\u4f7f\u8fd9\u4e9b\u503c\u4e0d\u592a\u53ef\u80fd\u6b8b\u7559\u4e0b\u6765\u4f9b\u540e\u7eed\u7684\u4fe1\u606f\u6cc4\u9732\u6216\u4fa7\u4fe1\u9053\u5229\u7528\u3002\u5176\u4e8c\u662f\u524a\u51cf\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff08ROP\uff09\u53ef\u7528\u7684\u7d20\u6750\uff1a\u4ee3\u7801\u590d\u7528\u94fe\u4f9d\u8d56\u90a3\u4e9b\u80fd\u628a\u653b\u51fb\u8005\u9009\u5b9a\u7684\u503c\u88c5\u5165\u5bc4\u5b58\u5668\u7684 gadget\uff0c\u6e05\u96f6\u8fd9\u4e9b\u5bc4\u5b58\u5668\u5c31\u6d88\u9664\u4e86\u8bb8\u591a\u6b64\u7c7b gadget\uff0c\u5c24\u5176\u662f\u81ea\u52a8\u5316 ROP \u94fe\u6784\u9020\u5de5\u5177\u5728\u7b2c\u4e00\u9636\u6bb5\u6240\u4f9d\u8d56\u7684\u3001\u7531\u7f16\u8bd1\u5668\u751f\u6210\u7684**\u201c\u5199\u4efb\u610f\u5730\u5740\u4efb\u610f\u503c\u201d**\uff08write-what-where\uff09gadget\u3002\u4ee5\n```plaintext\nused-gpr\n```\n\u6784\u5efa Linux \u5185\u6838\uff0c\u4f7f\u6240\u751f\u6210\u955c\u50cf\u4e2d\u552f\u4e00 ROP gadget \u7684\u6570\u91cf\u51cf\u5c11\u4e86\u7ea6 20% [89]\uff1b\u53e6\u4e00\u9879\u9488\u5bf9\u8fd9\u6837\u6784\u5efa\u7684\u5185\u6838\u7684\u72ec\u7acb\u6d4b\u91cf\u62a5\u544a\u79f0\u552f\u4e00 ROP gadget \u51cf\u5c11\u4e86 36.5%\uff0c\u5e76\u89c2\u5bdf\u5230\u81ea\u52a8 ROP \u94fe\u751f\u6210\u56e0\u7f3a\u5c11\u53ef\u7528\u7684\u901a\u7528\u5bc4\u5b58\u5668\u5199\u5165 gadget \u800c\u5728\u65e9\u671f\u9636\u6bb5\u5c31\u5931\u8d25\u4e86 [90]\u3002\n\n\u8fd9\u662f\u4e00\u79cd\u7f13\u89e3\u63aa\u65bd\uff0c\u800c\u4e0d\u662f\u4e00\u9053\u5c4f\u969c\u3002\u540c\u4e00\u9879\u6d4b\u91cf\u53d1\u73b0 JOP \u4e0e SYS gadget \u7684\u6570\u91cf**\u589e\u52a0**\u4e86\u7ea6 13%\uff0c\u56e0\u4e3a\u65b0\u589e\u7684\u6536\u5c3e\u4ee3\u7801\u4e3a\u672a\u5bf9\u9f50\u6307\u4ee4 gadget \u5236\u9020\u4e86\u66f4\u591a\u5019\u9009\uff1b\u5e76\u4e14\u53ef\u4ee5\u7528\u672a\u5bf9\u9f50\u7684\u504f\u79fb\uff08\u4ecd\u80fd\u5f97\u5230\u53ef\u7528 gadget\uff09\u7ed5\u8fc7\u6e05\u96f6 [90]\u3002\u5bc4\u5b58\u5668\u6e05\u96f6\u5e94\u88ab\u89c6\u4e3a\u4e0e\u4e0a\u8ff0\u63a7\u5236\u6d41\u4fdd\u62a4\u5e76\u5217\u7684\u4e00\u5c42\u7eb5\u6df1\u9632\u5fa1\uff0c\u800c\u4e0d\u662f\u5b83\u4eec\u7684\u66ff\u4ee3\u54c1\u3002\n\n`choice` \u53c2\u6570\u9009\u62e9\u6e05\u96f6\u54ea\u4e9b\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\u3002\u4e09\u4e2a\u57fa\u672c\u53d6\u503c\u662f `skip`\uff08\u4e0d\u6e05\u96f6\u4efb\u4f55\u5bc4\u5b58\u5668\uff0c\u9ed8\u8ba4\uff09\u3001`used`\uff08\u53ea\u6e05\u96f6\u51fd\u6570\u8bbe\u7f6e\u6216\u5f15\u7528\u8fc7\u5176\u5185\u5bb9\u7684\u5bc4\u5b58\u5668\uff09\u4e0e `all`\uff08\u6e05\u96f6\u6240\u6709\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\uff09\u3002\u52a0\u4e0a\n```plaintext\n-gpr\n```\n\u4f1a\u628a\u6e05\u96f6\u9650\u5236\u5728\u901a\u7528\u5bc4\u5b58\u5668\uff0c\u52a0\u4e0a\n```plaintext\n-arg\n```\n\u5219\u9650\u5236\u5728\u6309\u5e73\u53f0\u8c03\u7528\u7ea6\u5b9a\u53ef\u7528\u4e8e\u4f20\u9012\u53c2\u6570\u7684\u5bc4\u5b58\u5668\u3002\u8fd9\u4e24\u4e2a\u4fee\u9970\u7b26\u53ef\u4ee5\u5355\u72ec\u6216\u7ec4\u5408\u4f7f\u7528\uff0c\u4e14\u987a\u5e8f\u56fa\u5b9a\uff0c\u4e8e\u662f\u5b8c\u6574\u96c6\u5408\u4e3a\n```plaintext\nskip\n```\n\u3001\n```plaintext\nused\n```\n\u3001\n```plaintext\nused-arg\n```\n\u3001\n```plaintext\nused-gpr\n```\n\u3001\n```plaintext\nused-gpr-arg\n```\n\u3001\n```plaintext\nall\n```\n\u3001\n```plaintext\nall-arg\n```\n\u3001\n```plaintext\nall-gpr\n```\n\u4e0e\n```plaintext\nall-gpr-arg\n```\n[91]\u3002GCC 14 \u589e\u52a0\u4e86\u7b2c\u56db\u4e2a\u57fa\u672c\u53d6\u503c\n```plaintext\nleafy\n```\n\uff0c\u5b83\u5728\u53f6\u5b50\u51fd\u6570\u4e2d\u7b49\u540c\u4e8e\n```plaintext\nused\n```\n\uff0c\u5728\u975e\u53f6\u5b50\u51fd\u6570\u4e2d\u7b49\u540c\u4e8e\n```plaintext\nall\n```\n\uff0c\u5176\u4fee\u9970\u5f62\u5f0f\u540c\u7406 [91]\u3002\n\n\u6211\u4eec\u63a8\u8350\n```plaintext\n-fzero-call-used-regs=used-gpr\n```\n\u3002\u542f\u7528\n```plaintext\nCONFIG_ZERO_CALL_USED_REGS\n```\n\u65f6 Linux \u5185\u6838\u6b63\u662f\u7528\u8fd9\u4e2a\u503c\u6784\u5efa [89]\uff0c\u5b83\u8986\u76d6\u4e86 ROP \u94fe\u4e0e\u57fa\u4e8e\u5bc4\u5b58\u5668\u7684\u4fe1\u606f\u6cc4\u9732\u771f\u6b63\u4f9d\u8d56\u7684\u901a\u7528\u5bc4\u5b58\u5668\uff0c\u540c\u65f6\u6e05\u96f6\u7684\u5bc4\u5b58\u5668\u6570\u91cf\u6700\u5c11\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u4ee3\u4ef7\u4e0e\u6bcf\u6b21\u51fd\u6570\u8fd4\u56de\u65f6\u6e05\u96f6\u7684\u5bc4\u5b58\u5668\u6570\u91cf\u6210\u6b63\u6bd4\uff0c\u56e0\u6b64\u6309\n```plaintext\nused-gpr\n```\n\u3001\n```plaintext\nused\n```\n\u3001\n```plaintext\nall-gpr\n```\n\u3001\n```plaintext\nall\n```\n\u7684\u987a\u5e8f\u9012\u589e\uff1b\n```plaintext\nall\n```\n\u7cfb\u5217\u8981\u4e3a\u51fd\u6570\u4ece\u672a\u89e6\u53ca\u7684\u5bc4\u5b58\u5668\u4ed8\u51fa\u6e05\u96f6\u6210\u672c\u3002\u5bf9\u4e8e\n```plaintext\nused-gpr\n```\n\uff0cLinux \u5185\u6838\u6587\u6863\u7ed9\u51fa\u7684\u6027\u80fd\u5f71\u54cd\u662f\u5728\u591a\u6570\u5de5\u4f5c\u8d1f\u8f7d\u4e0a\u4f4e\u4e8e 1% [89]\u3002\n\n\u4e8c\u8fdb\u5236\u5927\u5c0f\u4e5f\u4f1a\u589e\u957f\uff0c\u4e14\u589e\u957f\u5e45\u5ea6\u4f9d\u67b6\u6784\u800c\u5f02\uff1a\u5185\u6838\u62a5\u544a\u5728 x86_64 \u4e0a\u955c\u50cf\u589e\u957f\u4f4e\u4e8e 1%\uff0c\u5728 arm64 \u4e0a\u7ea6\u4e3a 5% [89]\u3002\u5bf9\u4e8c\u8fdb\u5236\u5927\u5c0f\u654f\u611f\u7684\u9879\u76ee\u5728\u542f\u7528\u8be5\u9009\u9879\u524d\u5e94\u6d4b\u91cf\u5176\u5728\u81ea\u8eab\u76ee\u6807\u5e73\u53f0\u4e0a\u7684\u5f71\u54cd\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u4e0d\u8981\u5728 16.0.0 \u4e4b\u524d\u7684 Clang \u7248\u672c\u4e0a\u4f7f\u7528\u6b64\u9009\u9879\u3002Clang \u5728 15.0.0 \u4e2d\u5b9e\u73b0\u4e86\n```plaintext\n-fzero-call-used-regs\n```\n\uff0c\u4f46\u8be5\u5b9e\u73b0\u4e2d\u7684\u4e00\u4e2a\u4ee3\u7801\u751f\u6210\u7f3a\u9677\u53ef\u80fd\u4ea7\u751f\u975e\u6cd5\u4ee3\u7801\uff0c\u5bfc\u81f4\u8fd0\u884c\u65f6\u7a7a\u6307\u9488\u89e3\u5f15\u7528 [92]\u3002\n\n\u4f9d\u8d56\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\u5185\u5bb9\u5728\u51fd\u6570\u8fd4\u56de\u540e\u4f9d\u7136\u5b58\u6d3b\u7684\u4ee3\u7801\u53ef\u80fd\u4e0d\u517c\u5bb9\uff0c\u4f8b\u5982\u624b\u5199\u6c47\u7f16\u3001\u4f7f\u7528\u975e\u6807\u51c6\u8c03\u7528\u7ea6\u5b9a\u7684\u51fd\u6570\uff0c\u6216\u5728\u5e73\u53f0 ABI \u4e4b\u5916\u901a\u8fc7\u8c03\u7528\u8005\u4fdd\u5b58\u5bc4\u5b58\u5668\u8fd4\u56de\u503c\u7684\u63a5\u53e3\u3002\n\n\u652f\u6301\u60c5\u51b5\u8fd8\u4f9d\u76ee\u6807\u5e73\u53f0\u800c\u5f02\uff0c\u4e14\u4e24\u4e2a\u7f16\u8bd1\u5668\u4e4b\u95f4\u4e5f\u4e0d\u76f8\u540c\u3002Clang \u4e3a x86 \u4e0e AArch64 \u5b9e\u73b0\u4e86\u8be5\u9009\u9879\uff0cRISC-V \u652f\u6301\u5728 Clang 23 \u4e2d\u52a0\u5165 [93]\u3002GCC \u4ee5\u901a\u7528\u65b9\u5f0f\u5b9e\u73b0\u5bc4\u5b58\u5668\u6e05\u96f6\uff0c\u56e0\u6b64\u4e0d\u5c40\u9650\u4e8e\u56fa\u5b9a\u7684\u67b6\u6784\u5217\u8868\uff0c\u5e76\u4e3a x86\u3001SPARC \u4e0e RISC-V \u63d0\u4f9b\u9488\u5bf9\u7279\u5b9a\u76ee\u6807\u7684\u5b9e\u73b0\uff1bSPARC \u4ec5\u7531 GCC \u652f\u6301 [94]\u3002\u4e24\u4e2a\u7f16\u8bd1\u5668\u90fd\u5728\u672c\u6307\u5357\u63a8\u8350\u7684\u4e24\u4e2a\u67b6\u6784\uff08x86_64 \u4e0e AArch64\uff09\u4e0a\u652f\u6301\u8be5\u9009\u9879\uff0cLinux \u5185\u6838\u5728\u4e24\u8005\u4e0a\u90fd\u542f\u7528\u4e86\u5bc4\u5b58\u5668\u6e05\u96f6\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u6b64\u9009\u9879\u4e0e `-fcf-protection=full` \u5e76\u4e0d\u91cd\u590d\uff0c\u5728 x86_64 \u4e0a\u4e24\u8005\u6700\u597d\u914d\u5408\u4f7f\u7528\uff0c\u56e0\u4e3a\u5b83\u4eec\u4f5c\u7528\u4e8e\u4ee3\u7801\u590d\u7528\u653b\u51fb\u7684\u4e0d\u540c\u9636\u6bb5\u3002Intel CET \u4fdd\u62a4\u63a7\u5236\u6d41\u672c\u8eab\uff1a\u5f71\u5b50\u6808\u68c0\u6d4b\u8fd4\u56de\u5730\u5740\u88ab\u7be1\u6539\uff0c\u95f4\u63a5\u5206\u652f\u8ddf\u8e2a\u7ea6\u675f\u95f4\u63a5\u5206\u652f\u53ef\u4ee5\u843d\u5230\u4f55\u5904\u3002\u5bc4\u5b58\u5668\u6e05\u96f6\u6839\u672c\u4e0d\u68c0\u67e5\u63a7\u5236\u6d41\uff1b\u5b83\u79fb\u9664\u4ee3\u7801\u590d\u7528\u8f7d\u8377\u6240\u9700\u7684**\u6570\u636e**\uff0c\u7f29\u77ed\u5bc4\u5b58\u5668\u5185\u5bb9\u7684\u5b58\u6d3b\u65f6\u95f4\uff0c\u8ba9 gadget \u94fe\u7f3a\u5c11\u4f7f\u5176\u6709\u7528\u7684\u5bc4\u5b58\u5668\u5199\u5165\u3002\u5b83\u4eec\u7684\u7ec4\u5408\u5728\u53e6\u4e00\u65b9\u9762\u4e5f\u662f\u4e92\u8865\u7684\uff1a\u5bc4\u5b58\u5668\u6e05\u96f6\u4f1a\u7565\u5fae\u589e\u52a0 JOP gadget \u7684\u6570\u91cf [90]\uff0c\u800c JOP \u6b63\u662f\u95f4\u63a5\u5206\u652f\u8ddf\u8e2a\u6240\u7ea6\u675f\u7684\u90a3\u4e00\u7c7b\u3002\n\n\u53ef\u4ee5\u7528\n```plaintext\nzero_call_used_regs\n```\n\u51fd\u6570\u5c5e\u6027\u4e3a\u5355\u4e2a\u51fd\u6570\u8c03\u6574\u6e05\u96f6\u884c\u4e3a\uff0c\u5b83\u63a5\u53d7\u540c\u6837\u7684\n```plaintext\nchoice\n```\n\u53d6\u503c [91]\u3002\u5f53\u67d0\u4e2a\u51fd\u6570\u7684\u8c03\u7528\u7ea6\u5b9a\u4e0e\u8be5\u9009\u9879\u4e0d\u517c\u5bb9\u65f6\uff0c\u8fd9\u624d\u662f\u53d7\u652f\u6301\u7684\u8c41\u514d\u65b9\u5f0f\uff0c\u800c\u4e0d\u662f\u4e3a\u6574\u4e2a\u6784\u5efa\u653e\u5f03\u8be5\u9009\u9879\u3002\n\n\u9664 Linux \u5185\u6838\u4e4b\u5916\uff0cOpenSSH \u5728\u5176\u52a0\u56fa\u6784\u5efa\u4e2d\u542f\u7528\u4e86\n```plaintext\n-fzero-call-used-regs=used\n```\n\u3002OpenSSH \u7684\u6784\u5efa\u8fd8\u4f1a\u5728\u4f7f\u7528 Clang 17 \u65f6\u5173\u95ed\u8be5\u9009\u9879\uff0c\u56e0\u4e3a Clang 17 \u5728\u5176\u90e8\u5206\u6e90\u6587\u4ef6\u4e0a\u4f1a\u89e6\u53d1\u5185\u90e8\u7f16\u8bd1\u5668\u9519\u8bef\u3002\u8be5\u5931\u8d25\u662f\u6784\u5efa\u671f\u9519\u8bef\u800c\u975e\u9759\u9ed8\u7684\u9519\u8bef\u7f16\u8bd1\uff0c\u5e76\u4e14\u662f Clang 17 \u7279\u6709\u7684\uff1a\u540c\u6837\u7684\u6e90\u6587\u4ef6\u7528 Clang 16 \u53ef\u4ee5\u6784\u5efa\uff0cOpenSSH \u5bf9\u66f4\u665a\u7684 Clang \u7248\u672c\u4e5f\u6ca1\u6709\u65bd\u52a0\u6b64\u7c7b\u9650\u5236 [95]\u3002\n\n### \u9650\u5236\u5bf9\u5171\u4eab\u5bf9\u8c61\u7684 dlopen \u8c03\u7528\n\n- **`-Wl,-z,nodlopen`**\uff08Binutils 2.10.0\uff09\uff1a\u9650\u5236 `dlopen(3)` \u8c03\u7528\u52a0\u8f7d\u5171\u4eab\u5bf9\u8c61\u3002\n\n### \u6982\u8ff0\n\n\u5728\u6784\u5efa\u5171\u4eab\u5bf9\u8c61\u65f6\u4f20\u7ed9\u94fe\u63a5\u5668\u7684\n```plaintext\nnodlopen\n```\n\u9009\u9879\uff0c\u4f1a\u628a\u751f\u6210\u7684\u5bf9\u8c61\u6807\u8bb0\u4e3a\u4e0d\u53ef\u7528\u4e8e\n```plaintext\ndlopen(3)\n```\n\u8c03\u7528\u3002\u8fd9\u6709\u52a9\u4e8e\u524a\u5f31\u653b\u51fb\u8005\u52a0\u8f7d\u4e0e\u64cd\u7eb5\u5171\u4eab\u5bf9\u8c61\u7684\u80fd\u529b\u3002\u5728\u8fd0\u884c\u65f6\u5229\u7528\u4e2d\uff0c\u52a0\u8f7d\u65b0\u5bf9\u8c61\u6216\u5728\u8fdb\u7a0b\u4e2d\u590d\u5236\u4e00\u4e2a\u5df2\u5b58\u5728\u7684\u5171\u4eab\u5bf9\u8c61\uff0c\u53ef\u4ee5\u6784\u6210\u653b\u51fb\u94fe\u7684\u4e00\u90e8\u5206\u3002\n\n```plaintext\nnodlopen\n```\n\u7684\u9650\u5236\u57fa\u4e8e\u5728\u5bf9\u8c61\u7684\n```plaintext\n.dynamic\n```\n\u6bb5\u6807\u7b7e\u4e2d\u8bbe\u7f6e\n```plaintext\nDF_1_NOOPEN\n```\n\u6807\u5fd7\u3002\u7531\u4e8e\u53d7\u9650\u8c03\u7528\u7684\u5f3a\u5236\u5b9e\u65bd\u662f\u5728 libc \u5185\u90e8\u8c03\u7528\n```plaintext\ndlopen(3)\n```\n\u65f6\u5b8c\u6210\u7684\uff0c\u653b\u51fb\u8005\u4ecd\u6709\u53ef\u80fd\u7ed5\u8fc7\u8be5\u68c0\u67e5\uff1a1) \u5982\u679c\u653b\u51fb\u8005\u80fd\u591f\u4fee\u6539\u78c1\u76d8\u4e0a\u7684\u5bf9\u8c61\u6587\u4ef6\uff0c\u5c31\u53ef\u4ee5\u7be1\u6539\u5bf9\u8c61\u4e2d\u5d4c\u5165\u7684\u6807\u7b7e\uff1b\u6216 2) \u7ed5\u8fc7\n```plaintext\ndlopen(3)\n```\n\uff0c\u901a\u8fc7\u653b\u51fb\u8005\u63a7\u5236\u7684\u4ee3\u7801\uff08\u4f8b\u5982 shellcode \u7247\u6bb5\u6216\u9762\u5411\u8fd4\u56de\u7f16\u7a0b gadget\uff09\u52a0\u8f7d\u5171\u4eab\u5bf9\u8c61\u3002\u4e0d\u8fc7\uff0c\u94fe\u63a5\u65f6\u8bbe\u5b9a\u7684\n```plaintext\ndlopen(3)\n```\n\u9650\u5236\uff0c\u5728\u653b\u51fb\u8005\u83b7\u5f97\u4efb\u610f\u4ee3\u7801\u6267\u884c\u80fd\u529b\u4e4b\u524d\u4ecd\u6709\u52a9\u4e8e\u5bf9\u5176\u52a0\u4ee5\u7ea6\u675f\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u65e0\u3002\u628a\u5171\u4eab\u5bf9\u8c61\u6807\u8bb0\u4e3a\u9650\u5236\n```plaintext\ndlopen(3)\n```\n\u4e0d\u5f71\u54cd\u8fd0\u884c\u65f6\u6027\u80fd\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u5e94\u7528\u7a0b\u5e8f\u5e0c\u671b\u76f4\u63a5\u901a\u8fc7\n```plaintext\ndlopen(3)\n```\n\u7ba1\u7406\u5e93\u7684\u52a0\u8f7d\uff0c\u800c\u4e0d\u4f9d\u8d56\u5e38\u89c4\u7684\u52a8\u6001\u94fe\u63a5\u3002\u8fd9\u7c7b\u60c5\u5f62\u5305\u62ec\uff1a\n\n*   \u9009\u62e9\u8981\u52a0\u8f7d\u7684\u5e94\u7528\u7a0b\u5e8f\u63d2\u4ef6\n*   \u9009\u62e9\u9488\u5bf9\u7279\u5b9a CPU \u4f18\u5316\u7684\u5e93\u7248\u672c\u3002\u4f8b\u5982\uff0c\u4e3a\u4e0d\u540c\u73af\u5883\u63d0\u4f9b\u4e0d\u540c\u6570\u5b66\u8fd0\u7b97\u5b9e\u73b0\u7684\u6570\u5b66\u5e93\u5c31\u4f1a\u5229\u7528\u8fd9\u4e00\u70b9\u3002\n*   \u9009\u62e9\u4e0d\u540c\u5382\u5546\u5bf9\u67d0\u4e2a API \u7684\u5b9e\u73b0\n*   \u5ef6\u8fdf\u52a0\u8f7d\u5171\u4eab\u5e93\u4ee5\u7f29\u77ed\u5e94\u7528\u542f\u52a8\u65f6\u95f4\u3002\uff08\u53e6\u89c1\u7b2c 2.11 \u8282\u4e2d\u7684\u5ef6\u8fdf\u7ed1\u5b9a\uff09\n\n\u7531\u4e8e\n```plaintext\nnodlopen\n```\n\u4f1a\u5e72\u6270\u4f9d\u8d56\n```plaintext\ndlopen(3)\n```\n\u64cd\u7eb5\u5171\u4eab\u5bf9\u8c61\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u56e0\u6b64\u4e0d\u80fd\u7528\u4e8e\u4f9d\u8d56\u6b64\u7c7b\u529f\u80fd\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\n\n* * *\n\n### \u542f\u7528\u6570\u636e\u6267\u884c\u4fdd\u62a4\n\n- **`-Wl,-z,noexecstack`**\uff08Binutils 2.14.0\uff09\uff1a\u628a\u6808\u5185\u5b58\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\uff0c\u4ece\u800c\u542f\u7528\u6570\u636e\u6267\u884c\u4fdd\u62a4\u3002\n\n### \u6982\u8ff0\n\n\u6240\u6709\u4e3b\u6d41\u7684\u73b0\u4ee3\u5904\u7406\u5668\u67b6\u6784\u90fd\u5305\u542b\u5185\u5b58\u7ba1\u7406\u539f\u8bed\uff0c\u4f7f\u64cd\u4f5c\u7cfb\u7edf\u80fd\u591f\u628a\u67d0\u4e9b\u5185\u5b58\u533a\u57df\uff08\u5982\u6808\u4e0e\u5806\uff09\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\uff0c\u4f8b\u5982 AMD \u7684\u201c\u4e0d\u53ef\u6267\u884c\u201d\uff08NX\uff09\u4f4d\u4e0e Intel \u7684\u201c\u6267\u884c\u7981\u7528\u201d\uff08XD\uff09\u4f4d\u3002\u8be5\u673a\u5236\u963b\u6b62\u5728\u8fd0\u884c\u65f6\u653b\u51fb\u4e2d\u5229\u7528\u6808\u6216\u5806\u6ce8\u5165\u6076\u610f\u4ee3\u7801\u3002\n\n```plaintext\n-Wl,-z,noexecstack\n```\n\u9009\u9879\u544a\u8bc9\u94fe\u63a5\u5668\u628a\u76f8\u5e94\u7a0b\u5e8f\u6bb5\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\uff0c\u4ece\u800c\u4f7f\u64cd\u4f5c\u7cfb\u7edf\u5728\u628a\u53ef\u6267\u884c\u7a0b\u5e8f\u8f7d\u5165\u5185\u5b58\u65f6\u80fd\u6b63\u786e\u914d\u7f6e\u5185\u5b58\u8bbf\u95ee\u6743\u9650\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u65e0\u3002\u628a\u6808\u548c/\u6216\u5806\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\u4e0d\u5f71\u54cd\u8fd0\u884c\u65f6\u6027\u80fd\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u67d0\u4e9b\u8bed\u8a00\u5c42\u9762\u7684\u7f16\u7a0b\u6784\u9020\u2014\u2014\u4f8b\u5982\u53d6\u5d4c\u5957\u51fd\u6570 [32] \u7684\u5730\u5740\uff08GNU \u5bf9 ISO \u6807\u51c6 C \u7684\u6269\u5c55\uff09\u2014\u2014\u9700\u8981\u7279\u6b8a\u7684\u7f16\u8bd1\u5668\u5904\u7406\uff0c\u800c\u5982\u679c\u94fe\u63a5\u5668\u628a\u6808\u6bb5\u6807\u8bb0\u4e3a\u4e0d\u53ef\u6267\u884c\uff0c\u8fd9\u79cd\u5904\u7406\u53ef\u80fd\u65e0\u6cd5\u6b63\u5e38\u5de5\u4f5c [96]\u3002\n\n\u56e0\u6b64\n```plaintext\n-Wl,-z,noexecstack\n```\n\u6700\u597d\u4e0e\u9002\u5f53\u7684\u8b66\u544a\u9009\u9879\u914d\u5408\u4f7f\u7528\uff08\u5728\u53ef\u7528\u65f6\u4f7f\u7528 `-Wtrampolines`\uff09\uff0c\u4ee5\u6307\u793a\u6808\u865a\u62df\u5185\u5b58\u4fdd\u62a4\u662f\u5426\u4e0e\u67d0\u4e9b\u8bed\u8a00\u6784\u9020\u53d1\u751f\u51b2\u7a81\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u73b0\u4ee3\u7f16\u8bd1\u5668\u901a\u8fc7\n```plaintext\nPT_GNU_STACK\n```\n\u7a0b\u5e8f\u5934\u6761\u76ee\u4e2d\u7684\n```plaintext\np_flags\n```\n\u5b57\u6bb5\u81ea\u52a8\u5b8c\u6210\u8be5\u6807\u8bb0\uff0c\u94fe\u63a5\u5668\u5728\u51b3\u5b9a\u751f\u6210\u4e8c\u8fdb\u5236\u7684\u6807\u8bb0\u65f6\u4f1a\u67e5\u9605\u5404\u7ec4\u6210\u5bf9\u8c61\u7684\u6761\u76ee\u3002\u82e5\u7f3a\u5c11\u8be5\u6807\u8bb0\uff0c\u5185\u6838\u6216\u52a8\u6001\u94fe\u63a5\u5668\u5c31\u4e0d\u5f97\u4e0d\u5047\u5b9a\u4e8c\u8fdb\u5236\u53ef\u80fd\u9700\u8981\u53ef\u6267\u884c\u6808\u3002\n\n\u5728\u5185\u6838\u7248\u672c 5.8 \u4e4b\u524d\u7684 Linux \u4e0a\uff0cx86_64 \u4e0a\u7f3a\u5c11\n```plaintext\nPT_GNU_STACK\n```\n\u6807\u8bb0\u8fd8\u4f1a\u628a\u5176\u4ed6\u53ef\u8bfb\u9875\uff08\u4f8b\u5982\u7a0b\u5e8f\u7684\n```plaintext\n.data\n```\n\u6bb5\uff09\u66b4\u9732\u4e3a\u53ef\u6267\u884c [97]\uff0c\u800c\u4e0d\u4ec5\u4ec5\u662f\u5176\u6808\u5185\u5b58\u3002\u867d\u7136 x86_64 \u4e0a\u7684\u8fd9\u4e00\u884c\u4e3a\u6b64\u540e\u5df2\u6539\u53d8 [98]\uff0c\u6211\u4eec\u4ecd\u5efa\u8bae\u5728\u94fe\u63a5\u65f6\u663e\u5f0f\u542f\u7528\n```plaintext\n-Wl,-z,noexecstack\n```\n\uff0c\u4ee5\u5c3d\u53ef\u80fd\u5e7f\u6cdb\u5730\u786e\u4fdd\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u5bf9\u6808\u4e0e\u5176\u4ed6\u7a0b\u5e8f\u6570\u636e\u90fd\u4eab\u6709\u6570\u636e\u6267\u884c\u4fdd\u62a4\uff1b\u5e76\u5728\u53ef\u7528\u65f6\u914d\u5408 `-Wtrampolines` \u4f7f\u7528\uff0c\u4ee5\u9632\u517c\u5bb9\u6027\u95ee\u9898\u3002\u4f8b\u5982\uff0c\u5373\u4f7f\u5728\u8f83\u65b0\u7684 Linux \u5185\u6838\u7248\u672c\u4e0a\uff0c32 \u4f4d x86 \u67b6\u6784\u7684\u4e8c\u8fdb\u5236\u4e5f\u5fc5\u987b\u5e26\u6709\n```plaintext\nPT_GNU_STACK\n```\n\u6807\u8bb0\uff0c\u624d\u80fd\u5bf9\u6808\u548c\u5176\u4ed6\u7a0b\u5e8f\u6570\u636e\u4eab\u6709\u6570\u636e\u6267\u884c\u4fdd\u62a4\u3002\n\n* * *\n\n### \u628a\u5728\u52a0\u8f7d\u65f6\u89e3\u6790\u7684\u91cd\u5b9a\u4f4d\u8868\u9879\u6807\u8bb0\u4e3a\u53ea\u8bfb\n\n- **`-Wl,-z,relro` `-Wl,-z,now`**\uff08Binutils 2.15.0\uff09\uff1a\u628a\u5728\u52a0\u8f7d\u65f6\u89e3\u6790\u7684\u91cd\u5b9a\u4f4d\u8868\u9879\u6807\u8bb0\u4e3a\u53ea\u8bfb\u3002\n\n### \u6982\u8ff0\n\n**\u53ea\u8bfb\u91cd\u5b9a\u4f4d**\uff08RELRO\uff09\u4f1a\u5728\u52a8\u6001\u94fe\u63a5\u5668/\u52a0\u8f7d\u5668\uff08\n```plaintext\nld.so\n```\n\uff09\u89e3\u6790\u5b8c\u91cd\u5b9a\u4f4d\u8868\u9879\u4e4b\u540e\uff0c\u628a\u8fd9\u4e9b\u8868\u9879\u6807\u8bb0\u4e3a\u53ea\u8bfb\u3002\u91cd\u5b9a\u4f4d\u662f\n```plaintext\nld.so\n```\n\u6267\u884c\u7684\u8fc7\u7a0b\uff0c\u5b83\u628a\u672a\u89e3\u6790\u7684\u7b26\u53f7\u5f15\u7528\u8fde\u63a5\u5230\u5185\u5b58\u4e2d\u76f8\u5e94\u5bf9\u8c61\u7684\u6b63\u786e\u5730\u5740\u3002\n\n\u628a\u91cd\u5b9a\u4f4d\u6807\u8bb0\u4e3a\u53ea\u8bfb\uff0c\u53ef\u4ee5\u7f13\u89e3\u90a3\u4e9b\u901a\u8fc7\u7834\u574f\u5168\u5c40\u504f\u79fb\u8868\uff08GOT\uff09\u8868\u9879\u6765\u52ab\u6301\u7a0b\u5e8f\u6267\u884c\u6216\u5f15\u53d1\u975e\u9884\u671f\u6570\u636e\u8bbf\u95ee\u7684\u8fd0\u884c\u65f6\u653b\u51fb\u3002\u8fd9\u7c7b\u653b\u51fb\u7edf\u79f0\u4e3a**GOT \u8986\u76d6\u653b\u51fb**\uff08GOT overwrite attacks\uff09\u6216 **GOT \u52ab\u6301**\u3002\n\nRELRO \u53ef\u4ee5\u4ee5\u4e24\u79cd\u6a21\u5f0f\u4e4b\u4e00\u5b9e\u4f8b\u5316\uff1a\u90e8\u5206 RELRO \u6216\u5b8c\u5168 RELRO\u3002\u8981\u6709\u6548\u7f13\u89e3 GOT \u8986\u76d6\u653b\u51fb\uff0c\u5fc5\u987b\u4f7f\u7528\u5b8c\u5168 RELRO\uff1b\u90e8\u5206 RELRO \u4e0d\u8db3\u591f\u3002\n\n\u90e8\u5206 RELRO\uff08\n```plaintext\n-Wl,-z,relro\n```\n\uff09\u4f1a\u5728\u8fd0\u884c\u65f6\u52a0\u8f7d\u5668\u5b8c\u6210\u521d\u59cb\u5316\u540e\uff0c\u628a\u67d0\u4e9b ELF \u8282\u6807\u8bb0\u4e3a\u53ea\u8bfb\u3002\u8fd9\u4e9b\u8282\u5305\u62ec\n```plaintext\n.init_array\n```\n\u3001\n```plaintext\n.fini_array\n```\n\u3001\n```plaintext\n.dynamic\n```\n\uff0c\u4ee5\u53ca\n```plaintext\n.got\n```\n\u4e2d\u975e PLT \u7684\u90e8\u5206\u3002\u4f46\u5728\u90e8\u5206 RELRO \u4e0b\uff0cGOT \u4e2d\u7528\u4e8e\u8fc7\u7a0b\u94fe\u63a5\u7684\u9644\u52a0\u90e8\u5206\uff08\n```plaintext\n.got.plt\n```\n\uff09\u4ecd\u7136\u53ef\u5199\uff0c\u4ee5\u4fbf\u652f\u6301\u5ef6\u8fdf\u7ed1\u5b9a\u3002\n\n\u5b8c\u5168 RELRO\uff08\n```plaintext\n-Wl,-z,relro -Wl,-z,now\n```\n\uff09\u7981\u7528\u5ef6\u8fdf\u7ed1\u5b9a\u3002\u8fd9\u4f7f\n```plaintext\nld.so\n```\n\u80fd\u5728\u5e94\u7528\u7a0b\u5e8f\u542f\u52a8\u65f6\u89e3\u6790\u6574\u4e2a GOT\uff0c\u5e76\u628a GOT \u7684 PLT \u90e8\u5206\u4e5f\u6807\u8bb0\u4e3a\u53ea\u8bfb\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u5ef6\u8fdf\u7ed1\u5b9a\u7684\u4e3b\u8981\u76ee\u7684\u662f\u628a\u7b26\u53f7\u89e3\u6790\u64cd\u4f5c\u5206\u644a\u5230\u5e94\u7528\u7a0b\u5e8f\u6574\u4e2a\u751f\u547d\u5468\u671f\u4e2d\uff0c\u4ece\u800c\u52a0\u5feb\u542f\u52a8\u3002\u56e0\u6b64\uff0c\u5bf9\u52a8\u6001\u4f9d\u8d56\u6570\u91cf\u4f17\u591a\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u542f\u7528\u5b8c\u5168 RELRO \u4f1a\u589e\u52a0\u542f\u52a8\u65f6\u95f4\u3002\u6027\u80fd\u5f71\u54cd\u968f\u52a8\u6001\u94fe\u63a5\u51fd\u6570\u7684\u6570\u91cf\u800c\u589e\u957f\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u5bf9\u542f\u52a8\u65f6\u95f4\u6027\u80fd\u654f\u611f\u7684\u5e94\u7528\uff0c\u5e94\u6743\u8861\u5b8c\u5168 RELRO \u5e26\u6765\u7684\u542f\u52a8\u65f6\u95f4\u589e\u52a0\u662f\u5426\u5f71\u54cd\u7528\u6237\u4f53\u9a8c\u3002\u4f5c\u4e3a\u66ff\u4ee3\uff0c\u5f00\u53d1\u8005\u53ef\u4ee5\u8003\u8651\u628a\u8f83\u5927\u7684\u5e93\u4f9d\u8d56\u9759\u6001\u94fe\u63a5\u8fdb\u5e94\u7528\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\u3002\n\n\u9759\u6001\u94fe\u63a5\u5b8c\u5168\u907f\u514d\u4e86\u52a8\u6001\u7b26\u53f7\u89e3\u6790\u7684\u9700\u8981\uff0c\u4f46\u4e0e\u5347\u7ea7\u5171\u4eab\u5e93\u76f8\u6bd4\uff0c\u5b83\u4f1a\u8ba9\u7ed9\u4f9d\u8d56\u6253\u8865\u4e01\u53d8\u5f97\u66f4\u56f0\u96be\u3002\u5f00\u53d1\u8005\u9700\u8981\u8003\u8651\u81ea\u5df1\u7684\u90e8\u7f72\u573a\u666f\u662f\u5426\u4e0d\u5b9c\u9759\u6001\u94fe\u63a5\uff0c\u4f8b\u5982\u4e3b\u6d41 Linux \u53d1\u884c\u7248\u901a\u5e38\u7981\u6b62\u628a\u5171\u4eab\u7684\u5e94\u7528\u4f9d\u8d56\u9759\u6001\u94fe\u63a5\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u8981\u4eab\u6709\u90e8\u5206\u4e0e\u5b8c\u5168 RELRO \u7684\u76ca\u5904\uff0c\u5e94\u7528\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\u4ee5\u53ca\u94fe\u63a5\u5230\u8be5\u5e94\u7528\u7684\u4efb\u4f55\u5e93\u90fd\u5fc5\u987b\u7528\u76f8\u5e94\u7684\u7f16\u8bd1\u5668\u9009\u9879\u6784\u5efa\u3002\u5982\u679c\n```plaintext\nld.so\n```\n\u52a0\u8f7d\u4e86\u4efb\u4f55\u672a\u542f\u7528 RELRO \u7684\u5e93\uff0c\u8be5\u5e94\u7528\u7a0b\u5e8f\u7684 RELRO \u5c31\u4f1a\u88ab\u5173\u95ed\u3002\n\n* * *\n\n### \u6784\u5efa\u4e3a\u4f4d\u7f6e\u65e0\u5173\u4ee3\u7801\n\n- **`-fPIE -pie`**\uff08Binutils 2.16.0\u3001Clang 5.0.0\uff09\uff1a\u6784\u5efa\u4e3a\u4f4d\u7f6e\u65e0\u5173\u53ef\u6267\u884c\u6587\u4ef6\u3002\n- **`-fPIC -shared`**\uff08\u65e9\u4e8e Binutils 2.6.0\u3001Clang 5.0.0\uff09\uff1a\u6784\u5efa\u4e3a\u4f4d\u7f6e\u65e0\u5173\u4ee3\u7801\u3002\n\n### \u6982\u8ff0\n\n\u4f4d\u7f6e\u65e0\u5173\u4ee3\u7801\uff08PIC\uff09\u4e0e\u4f4d\u7f6e\u65e0\u5173\u53ef\u6267\u884c\u6587\u4ef6\uff08PIE\uff09\u662f\u65e0\u8bba\u88ab\u52a0\u8f7d\u5230\u8fdb\u7a0b\u5185\u5b58\u4e2d\u54ea\u4e2a\u786e\u5207\u5730\u5740\u90fd\u80fd\u6b63\u786e\u6267\u884c\u7684\u673a\u5668\u7801\u5bf9\u8c61\u3002\n\nGNU/Linux \u8981\u6c42\u628a\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\u6784\u5efa\u4e3a PIE\uff0c\u624d\u80fd\u4eab\u6709\u5730\u5740\u7a7a\u95f4\u5e03\u5c40\u968f\u673a\u5316\uff08ASLR\uff09\u3002\u5728\u73b0\u4ee3 GNU/Linux \u53d1\u884c\u7248\u4e2d\uff0cASLR \u662f\u7f13\u89e3\u4ee3\u7801\u590d\u7528\u6f0f\u6d1e\u5229\u7528\uff08\u4f8b\u5982**\u8fd4\u56de\u5230 libc**\uff08return-to-libc\uff09\u4e0e**\u9762\u5411\u8fd4\u56de\u7f16\u7a0b**\uff09\u7684\u4e3b\u8981\u624b\u6bb5\u3002\u5728\u4ee3\u7801\u590d\u7528\u6f0f\u6d1e\u5229\u7528\u4e2d\uff0c\u653b\u51fb\u8005\u7834\u574f\u8106\u5f31\u7684\u4ee3\u7801\u6307\u9488\u2014\u2014\u4f8b\u5982\u7a0b\u5e8f\u6808\u4e0a\u4fdd\u5b58\u7684\u8fd4\u56de\u5730\u5740\u2014\u2014\u4f7f\u5176\u6307\u5411\u7a0b\u5e8f\u5185\u5b58\u4e2d\u65e2\u6709\u7684\u53ef\u6267\u884c\u4ee3\u7801\u3002ASLR \u5728\u5bf9\u8c61\u6bcf\u6b21\u88ab\u8f7d\u5165\u5185\u5b58\u65f6\u968f\u673a\u5316\u5171\u4eab\u5e93\u4e0e\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\u7684\u4f4d\u7f6e\uff0c\u4f7f\u653b\u51fb\u4e2d\u6709\u7528\u7684\u5185\u5b58\u5730\u5740\u66f4\u96be\u9884\u6d4b\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u5728 64 \u4f4d\u67b6\u6784\u4e0a\u53ef\u5ffd\u7565\u3002\n\n\u5728 32 \u4f4d x86 \u4e0a\uff0cPIC \u8868\u73b0\u51fa\u4e2d\u7b49\u7a0b\u5ea6\u7684\u6027\u80fd\u635f\u5931\uff085\u201310%\uff09[23]\u3002\u539f\u56e0\u662f\u5728 32 \u4f4d x86 \u4e0a\uff0c\u7528\u4e8e\u6570\u636e\u8bbf\u95ee\u7684 mov \u6307\u4ee4\u53ea\u652f\u6301\u7edd\u5bf9\u5730\u5740\u3002\u4e3a\u4f7f\u4ee3\u7801\u4f4d\u7f6e\u65e0\u5173\uff0c\u5185\u5b58\u5f15\u7528\u88ab\u8f6c\u6362\u4e3a\u4ece\u5168\u5c40\u504f\u79fb\u8868\uff08GOT\uff09\u4e2d\u67e5\u8be2\u5185\u5b58\u5730\u5740\uff0c\u800c GOT \u5728\u52a0\u8f7d\u65f6\u88ab\u586b\u5165\u7a0b\u5e8f\u6570\u636e\u7684\u6b63\u786e\u5730\u5740\u3002\u56e0\u6b64\u5728 32 \u4f4d x86 \u4e0a\uff0c\u6570\u636e\u5f15\u7528\u76f8\u6bd4\u975e PIC \u4ee3\u7801\u9700\u8981\u591a\u4e00\u6b21\u5185\u5b58\u52a0\u8f7d\u3002\u4e0d\u8fc7\uff0c\u6027\u80fd\u635f\u5931\u7684\u4e3b\u8981\u539f\u56e0\u662f\u5bc4\u5b58\u5668\u538b\u529b\u4e0a\u5347\u2014\u2014\u5fc5\u987b\u628a\u4e00\u4e2a\u5bc4\u5b58\u5668\u5e38\u9a7b\u7528\u4e8e\u4fdd\u5b58\u6307\u5411 GOT \u7684\u67e5\u8be2\u57fa\u5740 [99]\u3002\n\nx86_64 \u67b6\u6784\u652f\u6301 mov \u7684\u4e00\u79cd\u53d8\u4f53\u4ee5\u53ca\u5176\u4ed6\u4e00\u4e9b\u6307\u4ee4\uff0c\u5b83\u4eec\u4f7f\u7528\u76f8\u5bf9\u4e8e\u6307\u4ee4\u6307\u9488\u7684\u504f\u79fb\u6765\u5bfb\u5740\u5185\u5b58\uff08\u5373\u5f53\u524d\u6267\u884c\u6307\u4ee4\u7684\u5730\u5740\uff09\u3002\u8fd9\u79f0\u4e3a RIP \u76f8\u5bf9\u5bfb\u5740\u3002x86_64 \u4e0a\u7684 PIC \u4f7f\u7528 RIP \u76f8\u5bf9\u5bfb\u5740\u8bbf\u95ee GOT\uff0c\u4ece\u800c\u7f13\u89e3\u4e86 32 \u4f4d x86 \u4e0a PIC \u76f8\u5173\u7684\u5bc4\u5b58\u5668\u538b\u529b\uff0c\u5bf9\u6027\u80fd\u7684\u5f71\u54cd\u4e5f\u66f4\u5c0f\u3002\u5728 x86_64 \u4e0a\uff0c\u5171\u4eab\u5e93\u9ed8\u8ba4\u5c31\u4ee5 PIC \u65b9\u5f0f\u521b\u5efa [100]\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u8d44\u6e90\u53d7\u9650\u7684\u5d4c\u5165\u5f0f\u7cfb\u7edf\u53ef\u4ee5\u901a\u8fc7\u5728\u7f16\u8bd1\u65f6\u5bf9\u53ef\u6267\u884c\u6587\u4ef6\u505a**\u9884\u94fe\u63a5**\uff08prelinking\uff09\u6765\u8282\u7701\u5185\u5b58\u3002\u9884\u94fe\u63a5\u63d0\u524d\u5b8c\u6210\u4e00\u4e9b\u901a\u5e38\u7531\u52a8\u6001\u94fe\u63a5\u5668\u505a\u51fa\u7684\u91cd\u5b9a\u4f4d\u51b3\u7b56\u3002\u7ed3\u679c\u662f\u52a8\u6001\u94fe\u63a5\u5668\u9700\u8981\u6267\u884c\u7684\u91cd\u5b9a\u4f4d\u66f4\u5c11\uff0c\u4ece\u800c\u7f29\u77ed\u5e94\u7528\u7684\u542f\u52a8\u65f6\u95f4\u5e76\u964d\u4f4e\u5185\u5b58\u6d88\u8017\u3002PIE \u5e76\u4e0d\u59a8\u788d\u9884\u94fe\u63a5\uff0c\u4f46\u5728\u5df2\u9884\u94fe\u63a5\u7684\u4e8c\u8fdb\u5236\u4e0a\u542f\u7528 ASLR \u4f1a\u8986\u76d6\u7f16\u8bd1\u671f\u7684\u51b3\u7b56\uff0c\u4ece\u800c\u4f7f\u9884\u94fe\u63a5\u5e26\u6765\u7684\u8fd0\u884c\u65f6\u5185\u5b58\u8282\u7701\u5931\u6548\u3002\u5982\u679c\u9884\u94fe\u63a5\u8282\u7701\u7684\u5185\u5b58\u5bf9\u7cfb\u7edf\u5f88\u91cd\u8981\uff0c\u53ef\u4ee5\u5bf9\u98ce\u9669\u8f83\u9ad8\u7684\u90a3\u90e8\u5206\u53ef\u6267\u884c\u6587\u4ef6\u542f\u7528 PIE\uff0c\u4f8b\u5982\u5904\u7406\u4e0d\u53ef\u4fe1\u5916\u90e8\u8f93\u5165\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\n\n* * *\n\n### \u4e0d\u8981\u5220\u9664\u7a7a\u6307\u9488\u68c0\u67e5\n\n- **`-fno-delete-null-pointer-checks`**\uff08GCC 3.0.0\u3001Clang 7.0.0\uff09\uff1a\u5f3a\u5236\u4fdd\u7559\u7a7a\u6307\u9488\u68c0\u67e5\u3002\n\n### \u6982\u8ff0\n\n\u5982\u679c\u4ee3\u7801\u7f3a\u9677\u5f15\u7528\u4e86\u53ef\u80fd\u4e3a\u7a7a\u7684\u6307\u9488\uff0c\u7f16\u8bd1\u5668\u88ab\u5141\u8bb8\u5220\u6389\u7a7a\u6307\u9488\u68c0\u67e5\uff0c\u5176\u7406\u8bba\u4f9d\u636e\u662f\u201c\u5f00\u53d1\u8005\u4ece\u4e0d\u72af\u9519\uff0c\u56e0\u6b64\u8be5\u6307\u9488\u68c0\u67e5\u662f\u591a\u4f59\u7684\u201d\u3002\n\n\u53ef\u5f00\u53d1\u8005**\u786e\u5b9e**\u4f1a\u72af\u9519\uff0c\u4e8e\u662f\u6ca1\u6709\u8fd9\u4e2a\u9009\u9879\u7684\u7ed3\u679c\u5c31\u662f\uff1a\u6e90\u7801**\u770b\u8d77\u6765**\u8981\u6c42\u4e86\u4e00\u9879\u5bf9\u5b89\u5168\u81f3\u5173\u91cd\u8981\u7684\u68c0\u67e5\uff0c\u4f46\u7f16\u8bd1\u51fa\u7684\u53ef\u6267\u884c\u6587\u4ef6**\u4e0d\u4f1a**\u6267\u884c\u8fd9\u9879\u68c0\u67e5\u3002\u8fd9\u4e2a\u9009\u9879\u662f\u591a\u65b9\u4e3a\u89e3\u51b3\u73b0\u5b9e\u4e16\u754c\u9519\u8bef\u800c\u63a8\u8350\u5e76\u4f7f\u7528\u7684\u82e5\u5e72\u9009\u9879\u4e4b\u4e00 [101]\u3002\n\n\u8fd9\u7c7b\u7f3a\u9677\u7684\u4e00\u4e2a\u4f8b\u5b50\u66fe\u51fa\u73b0\u5728 Linux \u5185\u6838\u4e2d\uff0c\u5e76\u5bfc\u81f4\u4e86\u4e00\u4e2a\u4e25\u91cd\u6f0f\u6d1e\u3002\u5728\u4e0b\u9762\u7b80\u5316\u7684 Linux \u5185\u6838\u4ee3\u7801\u4e2d\uff0c\u8868\u8fbe\u5f0f\n```plaintext\ndev->priv\n```\n\u5047\u5b9a\n```plaintext\ndev\n```\n\u975e\u7a7a\u3002\u8fd9\u610f\u5473\u7740\u82e5\n```plaintext\ndev\n```\n\u4e3a\u7a7a\uff0c\u5c31\u51fa\u73b0\u4e86\u672a\u5b9a\u4e49\u884c\u4e3a\u3002\u6b64\u4f8b\u4e2d C \u7f16\u8bd1\u5668\u8ba4\u5b9a\n```plaintext\ndev\n```\n\u4e0d\u53ef\u80fd\u4e3a\u7a7a\uff0c\u4e8e\u662f\u628a\n```plaintext\nif (!dev) return\n```\n\u8fd9\u6bb5\u4ee3\u7801\u4e22\u5f03\u4e86\uff08\u8be6\u89c1 [102]\uff09\uff1a\n\n```\nstatic void __devexit agnx_pci_remove (struct pci_dev *pdev)\n{\n  struct ieee80211_hw *dev = pci_get_drvdata(pdev);\n  struct agnx_priv *priv = dev->priv; \n\n  if (!dev) return;\n\n  ... do stuff using dev ...\n}\n```\n\nLinux \u5185\u6838\u73b0\u5728\u542f\u7528\u4e86\n```plaintext\n-fno-delete-null-pointer-checks\n```\n\uff1b\u6b63\u5982 Linus Torvalds \u540e\u6765\u89e3\u91ca\u7684 [103]\uff1a\u201c\u6211\u4eec\u7684\u4ee3\u7801\u6709\u7f3a\u9677\uff0c\u5728 NULL \u6307\u9488\u68c0\u67e5\u4e4b\u524d\u5c31\u8bbf\u95ee\u4e86\u6307\u9488\uff0c\u4f46\u53ea\u8981\u7f16\u8bd1\u5668\u6ca1\u6709\u771f\u7684\u5220\u6389\u8fd9\u4e2a\u68c0\u67e5\uff0c\u8fd9\u4e2a\u7f3a\u9677\u5c31\u662f\u2018\u826f\u6027\u7684\u2019\u3002\u2026\u2026\u5220\u6389 NULL \u6307\u9488\u68c0\u67e5\uff0c\u5c31\u628a\u4e00\u4e2a\u826f\u6027\u7f3a\u9677\u53d8\u6210\u4e86\u53ef\u4ee5\u8f7b\u6613\u5229\u7528\u7684\u6f0f\u6d1e\uff0c\u53ea\u9700\u628a\u7528\u6237\u7a7a\u95f4\u6570\u636e\u6620\u5c04\u5230 NULL\u2026\u2026\uff08\u8fd9\u6837\u5c31\u907f\u514d\u4e86\u5185\u6838 oops\uff0c\u7136\u540e\u8ba9\u5185\u6838\u4f7f\u7528\u4e86\u7528\u6237\u63d0\u4f9b\u7684\u503c\uff01\uff09\u2026\u2026\u5185\u6838\u901a\u5e38\u771f\u7684\u4e0d\u60f3\u8981\u90a3\u79cd\u6807\u51c6\u6216\u8bb8\u5141\u8bb8\u3001\u4f46\u751f\u6210\u7684\u4ee3\u7801\u4e0e\u6e90\u7801\u4e0d\u7b26\u7684\u4f18\u5316\u3002\u201d\n\n```plaintext\n-fno-delete-null-pointer-checks\n```\n\u9009\u9879\u5f3a\u5236\u4fdd\u7559\u8fd9\u7c7b\u68c0\u67e5\uff0c\u5373\u4fbf\u7406\u8bba\u4e0a\u5b83\u4eec\u591a\u4f59\uff1bLinux \u5185\u6838\u5c31\u4f7f\u7528\u4e86\u5b83\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u901a\u5e38\u6ca1\u6709\u663e\u8457\u7684\u6027\u80fd\u5f71\u54cd\u3002\u7a7a\u6307\u9488\u68c0\u67e5\u6781\u5feb\uff0c\u800c\u4e14\u5e38\u5e38\u53ef\u4ee5\u7531 CPU \u5e76\u884c\u6267\u884c\u3002\n\n* * *\n\n### \u4e3a\u6709\u7b26\u53f7\u6574\u6570\u4e0e\u6307\u9488\u7b97\u672f\u6ea2\u51fa\u5b9a\u4e49\u884c\u4e3a\n\n- **`-fno-strict-overflow`**\uff08GCC 8.5.0\uff09\uff1a\u6709\u7b26\u53f7\u6574\u6570\u5728\u52a0\u6cd5\u3001\u51cf\u6cd5\u3001\u4e58\u6cd5\u4ee5\u53ca\u6307\u9488\u7b97\u672f\u4e2d\u7684\u6ea2\u51fa\uff0c\u6309\u4e8c\u8fdb\u5236\u8865\u7801\u8868\u793a\u56de\u7ed5\u3002\n- **`-fwrapv`**\uff08GCC 3.4.0\uff09\uff1a\u6709\u7b26\u53f7\u6574\u6570\u5728\u52a0\u6cd5\u3001\u51cf\u6cd5\u3001\u4e58\u6cd5\u4e2d\u7684\u6ea2\u51fa\uff0c\u6309\u4e8c\u8fdb\u5236\u8865\u7801\u8868\u793a\u56de\u7ed5\u3002\n- **`-fwrapv-pointer`**\uff08GCC 8.5.0\uff09\uff1a\u6307\u9488\u7b97\u672f\u4e0e\u4e58\u6cd5\u6309\u4e8c\u8fdb\u5236\u8865\u7801\u8868\u793a\u56de\u7ed5\u3002\n- **`-ftrapv`**\uff08GCC 3.3.0\uff09\uff1a\u6709\u7b26\u53f7\u6574\u6570\u5728\u52a0\u6cd5\u3001\u51cf\u6cd5\u3001\u4e58\u6cd5\u4e2d\u7684\u6ea2\u51fa\u4ee5 `SIGABRT` \u9677\u5165\u3002\n\n### \u6982\u8ff0\n\n\u5728 C \u4e0e C++ \u4e2d\uff0c\u65e0\u7b26\u53f7\u6574\u6570\u957f\u671f\u4ee5\u6765\u88ab\u5b9a\u4e49\u4e3a\u201c\u56de\u7ed5\u201d\u3002\u7136\u800c C \u4e0e C++ \u7f16\u8bd1\u5668\u9ed8\u8ba4\u5047\u5b9a\u5728\u5176\u4ed6\u60c5\u5f62\u4e0b\u4e0d\u4f1a\u53d1\u751f\u6ea2\u51fa\u3002\u8bed\u8a00\u89c4\u8303\u628a\u6709\u7b26\u53f7\u6570\u7b97\u672f\u4e2d\u7684\u6ea2\u51fa\u73b0\u4e3a\u672a\u5b9a\u4e49\u884c\u4e3a\u3002\u8fd9\u4f7f\u7f16\u8bd1\u5668\u53ef\u4ee5\u5047\u5b9a\u4e25\u683c\u7684\u6307\u9488\u8bed\u4e49\uff1a\u82e5\u7ed9\u6307\u9488\u52a0\u4e0a\u4e00\u4e2a\u504f\u79fb\u540e\u4e0d\u4ea7\u751f\u6307\u5411\u540c\u4e00\u5bf9\u8c61\u7684\u6307\u9488\uff0c\u5219\u8be5\u52a0\u6cd5\u662f\u672a\u5b9a\u4e49\u7684\u3002\u5728\u5b9e\u8df5\u4e2d\uff0c\u8fd9\u610f\u5473\u7740\u6e90\u7801\u4e2d\u5199\u4e0b\u7684\u91cd\u8981\u5b89\u5168\u68c0\u67e5\uff0c\u5728\u751f\u6210\u53ef\u6267\u884c\u4ee3\u7801\u65f6\u53ef\u80fd\u88ab\u9759\u9ed8\u5ffd\u7565\u3002\n\n\u4f8b\u5982\uff0c\u4e0b\u9762\u662f Linux \u5185\u6838\n```plaintext\nfs/open.c\n```\n\u4e2d\u7684\u4e00\u6bb5\u4ee3\u7801 [101]\uff1a\n\n```\nint do_fallocate(..., loff_t offset, loff_t len)\n{\n    struct inode *inode = ...;\n    if (offset < 0 || len <= 0)\n        return -EINVAL;\n    /* Check for wrap through zero too */\n    if ((offset + len > inode->i_sb->s_maxbytes)\n        || (offset + len < 0))\n        return -EFBIG;\n    ...\n}\n```\n\n\u5f00\u53d1\u8005**\u53ef\u80fd**\u671f\u671b\n```plaintext\noffset + len\n```\n\u7684\u8ba1\u7b97\u7ed3\u679c\u4f1a\u662f\u53ef\u7528\u4e8e\u6bd4\u8f83\u7684\u6709\u6548\u503c\u3002\u7136\u800c\uff0c\u82e5\u7f16\u8bd1\u5668\u5904\u4e8e\n```plaintext\nstrict-overflow\n```\n\u6a21\u5f0f\uff0c\u5b83\u4fbf\u53ef\u4ee5\u81ea\u884c\u8ba4\u5b9a\n```plaintext\noffset + len\n```\n\u6c38\u8fdc\u5927\u4e8e 0\uff0c\u4ece\u800c\u7701\u7565\u4e00\u9879\u91cd\u8981\u7684\u5b89\u5168\u68c0\u67e5\u3002\n\nLinux \u5185\u6838\u542f\u7528\n```plaintext\n-no-strict-overflow\n```\n\u6765\u964d\u4f4e\u6e90\u7801\u4e2d\u91cd\u8981\u5b89\u5168\u68c0\u67e5\u88ab\u7f16\u8bd1\u5668\u9759\u9ed8\u5ffd\u7565\u7684\u53ef\u80fd\u6027\u3002\n\n```plaintext\n-no-strict-overflow\n```\n\u7684\u66ff\u4ee3\u65b9\u6848\u662f\n```plaintext\n-fwrapv\n```\n\u4e0e\n```plaintext\n-ftrapv\n```\n\u9009\u9879\u3002\u4f7f\u7528\n```plaintext\n-fwrapv\n```\n\u65f6\uff0c\u6709\u7b26\u53f7\u6574\u6570\u6ea2\u51fa\u4f1a\u56de\u7ed5\uff08\u56e0\u800c\u662f\u5df2\u5b9a\u4e49\u7684\uff09\u3002\u4f7f\u7528\n```plaintext\n-ftrapv\n```\n\u65f6\uff0c\u6709\u7b26\u53f7\u6574\u6570\u6ea2\u51fa\u4f1a\u9677\u5165\uff0c\u4f8b\u5982\u5728 x86 \u4e0a\u6ea2\u51fa\u4f1a\u7ed9\u5e94\u7528\u53d1\u9001\n```plaintext\nSIGABRT\n```\n\u4fe1\u53f7\u3002\n\n\u81ea GCC 8.5 \u8d77\uff0c\n```plaintext\n-no-strict-overflow\n```\n\u7b49\u4ef7\u4e8e\n```plaintext\n-fwrapv -fwrapv-pointer\n```\n\uff0c\u800c GCC \u6587\u6863\u5efa\u8bae\u5728\u6d4b\u8bd5\u4e0e\u8c03\u8bd5\u671f\u95f4\u7528\n```plaintext\n-fsanitize=signed-integer-overflow\n```\n\u6765\u8bca\u65ad\u6709\u7b26\u53f7\u6574\u6570\u6ea2\u51fa\u95ee\u9898\u3002\u5728\u66f4\u65e9\u7684 GCC \u7248\u672c\u4e2d\uff0c\n```plaintext\n-no-strict-overflow\n```\n\u5e76\u672a\u5728\u6709\u7b26\u53f7\u6574\u6570\u4e0a\u5b8c\u5168\u5f3a\u5236\u4e8c\u8fdb\u5236\u8865\u7801\uff0c\u56e0\u800c\u4fdd\u7559\u4e86\u66f4\u591a\u4f18\u5316\u7a7a\u95f4 [101]\u3002\u5728 Clang \u4e2d\uff0c\n```plaintext\n-no-strict-overflow\n```\n\u9009\u9879\u88ab\u89c6\u4e3a\n```plaintext\n-fwrapv\n```\n\u7684\u540c\u4e49\u8bcd\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u81ea C23 [104] \u4e0e C++20 [105] \u8d77\uff0cC \u4e0e C++ \u6807\u51c6\u5bf9\u6709\u7b26\u53f7\u6574\u6570\u7c7b\u578b\u53ea\u652f\u6301\u4e8c\u8fdb\u5236\u8865\u7801\u8868\u793a [106]\u3002\u8fd9\u4e9b\u6807\u51c6\u7684\u65e9\u671f\u7248\u672c\u8fd8\u5141\u8bb8\u5176\u4ed6\u7b26\u53f7\u8868\u793a\u3002\u4ee5\u8fd9\u4e9b\u65e9\u671f\u8bed\u8a00\u7248\u672c\u4e3a\u76ee\u6807\u3001\u4e14\u4f9d\u8d56\u7279\u5b9a\u6709\u7b26\u53f7\u6574\u6570\u8868\u793a\u7684\u4ee3\u7801\uff0c\u4f1a\u4ee5\u4e00\u79cd\u975e\u5e38\u5fae\u5999\u7684\u65b9\u5f0f\u53d8\u5f97\u66f4\u4e0d\u53ef\u79fb\u690d\u3002\u7136\u800c\u5728\u5b9e\u8df5\u4e2d\uff0cGCC \u4e0e Clang \u90fd\u4e0d\u652f\u6301\u5176\u4ed6\u8868\u793a [107]\u3002\u8fd9\u610f\u5473\u7740\u5373\u4fbf\u5728 C23 \u4e0e C++20 \u4e4b\u524d\uff0cGCC \u4e0e Clang \u5bf9\u8fd9\u4e9b\u8bed\u8a00\u7684\u5b9e\u73b0\u5b9e\u9645\u4e0a\u5c31\u662f\u4e8c\u8fdb\u5236\u8865\u7801\u3002\u56e0\u6b64\u6211\u4eec\u8ba4\u4e3a\u591a\u6570\u4ee3\u7801\u90fd\u80fd\u4ece\n```plaintext\n-fno-strict-overflow\n```\n\u6216\u5176\u66ff\u4ee3\u65b9\u6848\u4e2d\u53d7\u76ca\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u4e0e\u9ed8\u8ba4\u7684\n```plaintext\n-fstrict-overflow\n```\n\u884c\u4e3a\u76f8\u6bd4\uff0c\u8fd9\u4e9b\u9009\u9879\u90fd\u8ba9\u7f16\u8bd1\u5668\u5728\u4f18\u5316\u751f\u6210\u7684\u673a\u5668\u7801\u65f6\u81ea\u7531\u5ea6\u66f4\u5c0f\u3002\u4f8b\u5982\u5728\n```plaintext\n-fstrict-overflow\n```\n\u8bed\u4e49\u4e0b\uff0c\u5bf9\u5e26\u7b26\u53f7\u7684\n```plaintext\ni\n```\n\uff0c\u50cf\n```plaintext\ni + 10 > i\n```\n\u8fd9\u6837\u7684\u8868\u8fbe\u5f0f\u6052\u4e3a\u771f\uff0c\u56e0\u6b64\u8be5\u8868\u8fbe\u5f0f\u53ef\u4ee5\u5728\u7f16\u8bd1\u671f\u88ab\u66ff\u6362\u4e3a\u5e38\u91cf\u3002\u5982\u4e0a\u6240\u8ff0\uff0c\u82e5\u8fd9\u7c7b\u8868\u8fbe\u5f0f\u51fa\u73b0\u5728\u6761\u4ef6\u68c0\u67e5\u4e2d\uff0c\u5f53\u8868\u8fbe\u5f0f\u53ef\u5728\u7f16\u8bd1\u671f\u6c42\u503c\u65f6\uff0c\u7f16\u8bd1\u5668\u53ef\u80fd\u628a\u6574\u6761\u4ee3\u7801\u8def\u5f84\u4f18\u5316\u6389\u3002\u76f8\u53cd\uff0c\u5728\n```plaintext\n-fno-strict-overflow\n```\n\u4e0b\uff0c\u8fd9\u4e9b\u8868\u8fbe\u5f0f\u5fc5\u987b\u5728\u8fd0\u884c\u65f6\u6c42\u503c\uff0c\u4ee5\u9632\u51fa\u73b0\u56de\u7ed5\u7684\u6ea2\u51fa\uff0c\u4ece\u800c\u963b\u6b62\u4e86\u67d0\u4e9b\u4f18\u5316\u3002\u53e6\u4e00\u65b9\u9762\uff0c\u628a\u6ea2\u51fa\u73b0\u4e3a\u672a\u5b9a\u4e49\u884c\u4e3a\uff0c\u53ea\u6709\u5728\u7a0b\u5e8f\u5458\u80fd\u786e\u4fe1\u7a0b\u5e8f\u6c38\u8fdc\u4e0d\u4f1a\u63a5\u53d7\u5bfc\u81f4\u6ea2\u51fa\u7684\u8f93\u5165\u65f6\uff0c\u624d\u80fd\u5f97\u5230\u6700\u4f18\u8868\u73b0\u3002\n\n```plaintext\n-ftrapv\n```\n\u9009\u9879\u8981\u6c42\u7f16\u8bd1\u5668\u751f\u6210\u68c0\u67e5\uff0c\u4ee5\u68c0\u6d4b\u5e76\u9677\u5165\u6709\u7b26\u53f7\u6574\u6570\u4e0a\u7684\u6ea2\u51fa\uff0c\u9664\u975e\u5b83\u6709\u7f16\u8bd1\u671f\u7684\u53d6\u503c\u8303\u56f4\u4fe1\u606f\u80fd\u8bc1\u660e\u8be5\u8fd0\u7b97\u4e0d\u4f1a\u6ea2\u51fa\u3002\u56e0\u6b64\u5728\u672c\u8282\u6db5\u76d6\u7684\u9009\u9879\u4e2d\uff0c\n```plaintext\n-ftrapv\n```\n\u7684\u9884\u671f\u6027\u80fd\u5f71\u54cd\u6700\u5927\u3002\n\n### \u5176\u4ed6\u8003\u91cf\n\n\u5728\u94fe\u63a5\u65f6\u4f18\u5316\uff08LTO\uff09\u671f\u95f4\uff0c\u4e0d\u540c\u7684\u7f16\u8bd1\u5355\u5143\u53ef\u80fd\u4ee5\u4e0d\u540c\u7684\u7b97\u672f\u6ea2\u51fa\u884c\u4e3a\u6784\u5efa\u3002\n```plaintext\n-fno-strict-overflow\n```\n\u3001\n```plaintext\n-fwrapv\n```\n\u3001\n```plaintext\n-fno-trapv\n```\n\u4e0e\n```plaintext\n-fno-strict-aliasing\n```\n\u4f1a\u88ab\u4f20\u9012\u5230\u94fe\u63a5\u9636\u6bb5\uff0c\u5e76\u5728\u884c\u4e3a\u51b2\u7a81\u7684\u7f16\u8bd1\u5355\u5143\u4e0a\u4f18\u5148\u4e8e\n```plaintext\n-fstrict-overflow\n```\n\u8bed\u4e49 [108]\u3002\u5728\u5b9e\u8df5\u4e2d\uff0c\u8fd9\u610f\u5473\u7740\u5982\u679c\u8f6f\u4ef6\u4e2d\u67d0\u4e9b\u6a21\u5757\u4e3a\u6027\u80fd\u800c\u53d7\u76ca\u4e8e\n```plaintext\n-fstrict-overflow\n```\n\uff0c\u800c\u53e6\u4e00\u4e9b\u6a21\u5757\u7528\n```plaintext\n-fno-strict-overflow\n```\n\u6765\u63d0\u5347\u5b89\u5168\u6027\uff0c\u90a3\u4e48\u5728 LTO \u671f\u95f4\n```plaintext\n-fno-strict-overflow\n```\n\u5360\u4f18\uff0c\u53ef\u80fd\u56e0\u6b64\u5931\u53bb\u90a3\u4e9b\u6027\u80fd\u6536\u76ca\u3002\n\n* * *\n\n### \u4e0d\u8981\u5047\u5b9a\u4e25\u683c\u522b\u540d\n\n- **`-fno-strict-aliasing`**\uff08GCC 2.95.3\u3001Clang 18.0.0\uff09\uff1a\u4e0d\u8981\u5047\u5b9a\u4e25\u683c\u522b\u540d\u3002\n\n### \u6982\u8ff0\n\n\u6307\u9488\u53ef\u4ee5\u4ece\u4e00\u79cd\u7c7b\u578b\u5f3a\u5236\u8f6c\u6362\u5230\u53e6\u4e00\u79cd\u7c7b\u578b\u3002\u6807\u51c6\u5bf9\u522b\u540d\u6709\u4e25\u683c\u7684\u89c4\u5219\uff0c\u8981\u6c42\u5728\u591a\u6570\u60c5\u51b5\u4e0b\u4e0d\u540c\u7c7b\u578b\u7684\u6307\u9488**\u4e0d**\u4e92\u4e3a\u522b\u540d\u3002\u7136\u800c\u5728\u5b9e\u8df5\u4e2d\uff0c\u8bb8\u591a\u6784\u9020\u4f9d\u8d56\u8fd9\u79cd\u522b\u540d\uff0c\u5c3d\u7ba1\u5b83\u662f\u672a\u5b9a\u4e49\u884c\u4e3a\u3002\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u672a\u5b9a\u4e49\u7684\u4ee3\u7801\u53ef\u4ee5\u505a**\u4efb\u4f55\u4e8b**\uff0c\u800c\u8fd9\u5e76\u4e0d\u7406\u60f3\u3002[101]\n\n\u6b64\u9009\u9879\u6d88\u9664\u4e86\u8fd9\u4e2a\u95ee\u9898\u3002Linux \u5185\u6838\u5c31\u4f7f\u7528\u5b83\u3002\n\n* * *\n\n### \u521d\u59cb\u5316\u7f3a\u5c11\u663e\u5f0f\u521d\u59cb\u5316\u5668\u7684\u81ea\u52a8\u53d8\u91cf\n\n- **`-ftrivial-auto-var-init`**\uff08GCC 12.0.0\u3001Clang 8.0.0\uff09\uff1a\u521d\u59cb\u5316\u7f3a\u5c11\u663e\u5f0f\u521d\u59cb\u5316\u5668\u7684\u81ea\u52a8\u53d8\u91cf\u3002\n\n### \u6982\u8ff0\n\n\u6b64\u9009\u9879\u63a7\u5236\u5728\u6ca1\u6709\u663e\u5f0f\u521d\u59cb\u5316\u5668\u65f6\uff0c\u7f16\u8bd1\u5668\u662f\u5426\uff08\u4ee5\u53ca\u5982\u4f55\uff09\u521d\u59cb\u5316\u81ea\u52a8\u53d8\u91cf\uff08\u5373\u5206\u914d\u5728\u6808\u4e0a\u7684\u53d8\u91cf\uff09\u3002\n\n\u6b64\u9009\u9879\u6709\u4e09\u79cd\u53d6\u503c\uff1a\n\n*   `uninitialized`\u2014\u2014\u4e0d\u521d\u59cb\u5316\u81ea\u52a8\u53d8\u91cf\u3002\u8fd9\u662f\u9ed8\u8ba4\u503c\u3002\n*   `pattern`\u2014\u2014\u7528\u82e5\u5b58\u5728\u903b\u8f91\u7f3a\u9677\u5219\u5f88\u53ef\u80fd\u5bfc\u81f4\u5d29\u6e83\u7684\u503c\u6765\u521d\u59cb\u5316\u81ea\u52a8\u53d8\u91cf\u3002\n*   `zero`\u2014\u2014\u7528\u96f6\u521d\u59cb\u5316\u81ea\u52a8\u53d8\u91cf\uff0c\u4ee5\u964d\u4f4e\u903b\u8f91\u7f3a\u9677\u6f14\u53d8\u4e3a\u5b89\u5168\u6f0f\u6d1e\u6216\u5176\u4ed6\u95ee\u9898\u7684\u98ce\u9669\u3002\n\n\u6211\u4eec\u5efa\u8bae\u751f\u4ea7\u4ee3\u7801\u4f7f\u7528\n```plaintext\nzero\n```\n\uff0c\u4ee5\u964d\u4f4e\u903b\u8f91\u7f3a\u9677\u6f14\u53d8\u4e3a\u5b89\u5168\u6f0f\u6d1e\u7684\u98ce\u9669\u3002\n\n\u5373\u4fbf\u4f7f\u7528\u4e86\u6b64\u9009\u9879\uff0c\u5c31\n```plaintext\n-Wuninitialized\n```\n\u4e0e\n```plaintext\n-Wanalyzer-use-of-uninitialized-value\n```\n\u6240\u6267\u884c\u7684\u9759\u6001\u5206\u6790\u800c\u8a00\uff0cGCC \u4ecd\u4f1a\u628a\u6ca1\u6709\u663e\u5f0f\u521d\u59cb\u5316\u5668\u7684\u81ea\u52a8\u53d8\u91cf\u89c6\u4e3a\u672a\u521d\u59cb\u5316\uff0c\u5e76\u76f8\u5e94\u5730\u62a5\u544a\u8b66\u544a\u8bca\u65ad [109]\u3002GCC \u8fd8\u4f1a\u6309\u53d8\u91cf\u672a\u521d\u59cb\u5316\u7684\u5047\u5b9a\u8fdb\u884c\u4f18\u5316\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u6b64\u9009\u9879\u5728\u81ea\u52a8\u53d8\u91cf\u88ab\u5206\u914d\u65f6\u5bf9\u5176\u8fdb\u884c\u521d\u59cb\u5316\uff0c\u8fd9\u53ef\u80fd\u7ed9\u7a0b\u5e8f\u589e\u52a0\u5f00\u9500\u3002\u4f8b\u5982\u5728\u6027\u80fd\u5173\u952e\u4ee3\u7801\u4e2d\uff0c\u53d8\u91cf\u7684\u521d\u59cb\u5316\u53ef\u80fd\u9700\u8981\u5728\u5b58\u50a8\u5206\u914d\u4e4b\u540e\u7684\u67d0\u4e2a\u7279\u5b9a\u70b9\u624d\u53d1\u751f\uff0c\u800c\n```plaintext\n-ftrivial-auto-var-init\n```\n\u6240\u751f\u6210\u7684\u4ee3\u7801\uff0c\u82e5\u5176\u63d2\u5165\u7684\u521d\u59cb\u5316\u843d\u5728\u6027\u80fd\u5173\u952e\u8def\u5f84\u4e0a\uff0c\u5c31\u4f1a\u62d6\u6162\u6267\u884c\u3002\n\n```plaintext\n-ftrivial-auto-var-init\n```\n\u589e\u52a0\u7684\u5f00\u9500\uff0c\u968f\u7f16\u8bd1\u5668\u4e3a\u5176\u751f\u6210\uff08\u591a\u4f59\uff09\u521d\u59cb\u5316\u4ee3\u7801\u7684\u5206\u914d\u7684\u5927\u5c0f\u4e0e\u9891\u6b21\u800c\u589e\u957f\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u81ea\u52a8\u521d\u59cb\u5316\u4f1a\u5e72\u6270 Valgrind [110]\u3001Dr. Memory [111] \u4e0e Clang \u7684 Memory Sanitizer [112] \u7b49\u52a8\u6001\u5206\u6790\u5de5\u5177\uff0c\u56e0\u4e3a\u5b83\u660e\u786e\u8bbe\u7f6e\u4e86\u6e90\u7801\u4ece\u672a\u8bbe\u7f6e\u7684\u503c\u3002\u8fd9\u4f1a\u63a9\u76d6\u672c\u53ef\u88ab\u53d1\u73b0\u5e76\u4fee\u590d\u7684\u672a\u521d\u59cb\u5316\u53d8\u91cf\u95ee\u9898\uff0c\u4f7f\u5176\u4e0d\u592a\u9002\u5408\u8c03\u8bd5\u4e0e\u8f6f\u4ef6\u6d4b\u8bd5\u3002\u56e0\u6b64\u6211\u4eec\u4e0d\u5efa\u8bae\u5bf9\u65e8\u5728\u505a\u672a\u521d\u59cb\u5316\u53d8\u91cf\u95ee\u9898\u52a8\u6001\u5206\u6790\u7684\u63d2\u6869\u6d4b\u8bd5\u4ee3\u7801\u4f7f\u7528\n```plaintext\n-ftrivial-auto-var-init\n```\n\n\u5728\u7279\u5b9a\u60c5\u51b5\u4e0b\uff0c\u6b64\u9009\u9879\u7684\n```plaintext\npattern\n```\n\u53d8\u4f53\u80fd\u8ba9\u672a\u521d\u59cb\u5316\u5185\u5b58\u5728\u8c03\u8bd5\u65f6\u66f4\u5bb9\u6613\u88ab\u53d1\u73b0\uff0c\u56e0\u4e3a\u6240\u7528\u7684\u6a21\u5f0f\u4e0d\u592a\u53ef\u80fd\u88ab\u5f53\u4f5c\u771f\u5b9e\u503c\u4f7f\u7528 [113]\u3002\u4f8b\u5982\uff0c\u6240\u9009\u7684\u6307\u9488\u503c\u5728\u8bb8\u591a\u7cfb\u7edf\u4e0a\u90fd\u662f\u65e0\u6548\u7684\u3002\n\n\u6b64\u5916\uff0c\u521d\u59cb\u5316\u6240\u6709\u81ea\u52a8\u53d8\u91cf\u53ef\u80fd\u5bfc\u81f4\u7f16\u8bd1\u540e\u7a0b\u5e8f\u7684\u4e8c\u8fdb\u5236\u5927\u5c0f\u589e\u52a0 [113]\u3002\u5728\u5185\u5b58\u53d7\u9650\u7684\u5d4c\u5165\u5f0f\u73af\u5883\u4e2d\uff0c\u8fd9\u53ef\u80fd\u6210\u4e3a\u95ee\u9898\u3002\n\n* * *\n\n### \u542f\u7528\u5f02\u5e38\u4f20\u64ad\u4ee5\u52a0\u56fa\u591a\u7ebf\u7a0b C \u4ee3\u7801\n\n- **`-fexceptions`**\uff08GCC 2.95.3\u3001Clang 2.6.0\uff09\uff1a\u542f\u7528\u5f02\u5e38\u4f20\u64ad\u4ee5\u52a0\u56fa\u591a\u7ebf\u7a0b C \u4ee3\u7801\u3002\n\n### \u6982\u8ff0\n\n```plaintext\n-fexceptions\n```\n\u9009\u9879\u5728\u7528\u4e8e C \u4ee3\u7801\u65f6\uff0c\u4f1a\u8ba9 GCC \u4e0e Clang \u4e3a\u6240\u6709\u51fd\u6570\u751f\u6210\u5e27\u5c55\u5f00\uff08frame unwind\uff09\u4fe1\u606f\u3002\u6b64\u9009\u9879\u5bf9\u9700\u8981\u5f02\u5e38\u5904\u7406\u7684 C++ \u9ed8\u8ba4\u542f\u7528\uff0c\u4f46\u628a\u5b83\u540c\u6837\u7528\u4e8e C \u4ee3\u7801\uff0c\u5c31\u80fd\u8ba9 glibc \u5bf9 POSIX \u7ebf\u7a0b\u53d6\u6d88\u7684\u5b9e\u73b0 [114] \u4f7f\u7528\u540c\u6837\u7684\u5c55\u5f00\u4fe1\u606f\uff0c\u800c\u4e0d\u5fc5\u7528\n```plaintext\nsetjmp\n```\n/\n```plaintext\nlongjmp\n```\n\u6765\u505a\u6808\u5c55\u5f00 [115]\u3002\n\n\u5efa\u8bae\u5bf9\u591a\u7ebf\u7a0b C \u4ee3\u7801\u7684\u52a0\u56fa\u542f\u7528\n```plaintext\n-fexceptions\n```\n\uff0c\u56e0\u4e3a\u82e5\u4e0d\u542f\u7528\uff0cglibc \u7684\u7ebf\u7a0b\u53d6\u6d88\u5904\u7406\u5b9e\u73b0\u53ef\u80fd\u628a\u4e00\u4e2a\u5b8c\u5168\u672a\u53d7\u4fdd\u62a4\u7684\u51fd\u6570\u6307\u9488\u6ea2\u51fa\u5230\u6808\u4e0a [116]\u3002\u5373\u4fbf\u76f8\u5173\u7ebf\u7a0b\u4ece\u672a\u88ab\u53d6\u6d88\uff0c\u8fd9\u4e2a\u51fd\u6570\u6307\u9488\u4e5f\u80fd\u7b80\u5316\u5bf9\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u5229\u7528 [117]\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n\u4e3a C \u4ee3\u7801\u542f\u7528 C++ \u98ce\u683c\u7684\u5f02\u5e38\u4f20\u64ad\u4e00\u822c\u4e0d\u5f71\u54cd\u5176\u6027\u80fd\uff0c\u56e0\u4e3a\u5b83\u4e0d\u5f71\u54cd\u7a0b\u5e8f\u7684\u6b63\u5e38\u63a7\u5236\u6d41\u3002\u7136\u800c\u5728\u67d0\u4e9b\u76ee\u6807\u67b6\u6784\uff08\u5982 x86_64\uff09\u4e0a\uff0c\n```plaintext\n-fexceptions\n```\n\u4f1a\u5bfc\u81f4\u7f16\u8bd1\u5668\u4e3a\u6240\u6709\u51fd\u6570\u751f\u6210\u5e27\u5c55\u5f00\u4fe1\u606f\uff0c\u8fd9\u53ef\u80fd\u4f7f\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u5927\u5c0f\u663e\u8457\u589e\u52a0\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u5728\u5f00\u53d1\u65e0\u9700\u4e0e C++ \u4e92\u64cd\u4f5c\u7684\u5355\u7ebf\u7a0b C \u4ee3\u7801\u3001\u4e14\u76ee\u6807\u4e3a\u8d44\u6e90\u53d7\u9650\u7cfb\u7edf\u800c\u5bf9\u76f8\u5173\u4e8c\u8fdb\u5236\u5927\u5c0f\u589e\u957f\u4e0d\u53ef\u63a5\u53d7\u65f6\uff0c\u53ef\u4ee5\u5b89\u5168\u5730\u7701\u7565\u6b64\u9009\u9879\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u5bf9\u9700\u8981\u4e0e\u4f9d\u8d56\u5f02\u5e38\u7684 C++ \u4ee3\u7801\u4e92\u64cd\u4f5c\u7684 C \u4ee3\u7801\uff0c\u540c\u6837\u9700\u8981\n```plaintext\n-fexceptions\n```\n\u9009\u9879\u3002\u56e0\u6b64\uff0c\u5404\u5927 Linux \u53d1\u884c\u7248\u63d0\u4f9b\u7684 C \u8bed\u8a00\u5e93\u5e38\u5e38\u9ed8\u8ba4\u542f\u7528\n```plaintext\n-fexceptions\n```\n\n* * *\n\n### \u5728 GCC \u4e2d\u542f\u7528\u4e00\u7ec4\u9884\u5b9a\u7684\u52a0\u56fa\u9009\u9879\n\n- **`-fhardened`**\uff08GCC 14.0.0\uff09\uff1a\u5728 GCC \u4e2d\u4e3a C \u4e0e C++ \u542f\u7528\u4e00\u7ec4\u9884\u5b9a\u7684\u52a0\u56fa\u9009\u9879\u3002\n- **`-Whardened`**\uff08GCC 14.0.0\uff09\uff1a\u5f53 `-fhardened` \u6240\u9690\u542b\u7684\u9009\u9879\u88ab\u964d\u7ea7\u6216\u5173\u95ed\u65f6\u53d1\u51fa\u8b66\u544a\u3002\n\n### \u6982\u8ff0\n\n```plaintext\n-fhardened\n```\n\u8fd9\u4e2a\u4f1e\u5f62\u9009\u9879\u5728 GNU/Linux \u76ee\u6807\u4e0a\u4e3a C \u4e0e C++ \u542f\u7528\u4e00\u7ec4\u9884\u5b9a\u7684\u52a0\u56fa\u9009\u9879 [118]\u3002\u5177\u4f53\u9009\u9879\u96c6\u5408\u53ef\u80fd\u5728 GCC \u5404\u4e3b\u7248\u672c\u4e4b\u95f4\u53d8\u5316\u3002\u67d0\u4e2a\u7279\u5b9a GCC \u7248\u672c\u7684\u786e\u5207\u9009\u9879\u96c6\u5408\u53ef\u4ee5\u7528\n```plaintext\n--help=hardened\n```\n\u9009\u9879\u663e\u793a\u3002\n\n### \u5176\u4ed6\u6ce8\u610f\u4e8b\u9879\n\n\u5728\u7f16\u8bd1\u5668\u547d\u4ee4\u884c\u4e0a\u663e\u5f0f\u6307\u5b9a\u7684\u9009\u9879\uff0c\u603b\u662f\u4f18\u5148\u4e8e\n```plaintext\n-fhardened\n```\n\u6240\u9690\u542b\u7684\u9009\u9879\u3002\u4f8b\u5982 GCC 14 \u4e2d\u7684\n```plaintext\n-fhardened\n```\n\u4f1a\u542f\u7528\n```plaintext\n-fstack-protector-strong\n```\n\uff0c\u4f46\u5728\u547d\u4ee4\u884c\u4e0a\u6307\u5b9a\n```plaintext\n-fstack-protector -fhardened\n```\n\u6216\n```plaintext\n-fhardened -fstack-protector\n```\n\uff0c\u5c31\u4f1a\u542f\u7528\u8f83\u5f31\u7684\n```plaintext\n-fstack-protector\n```\n\u800c\u4e0d\u662f\n```plaintext\n-fstack-protector-strong\n```\n\u3002\n\n\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u5f53\n```plaintext\n-fhardened\n```\n\u6240\u9690\u542b\u7684\u9009\u9879\u56e0\u547d\u4ee4\u884c\u9009\u9879\u4f18\u5148\u3001\u6216\u7f3a\u5c11\u524d\u7f6e\u6761\u4ef6\uff08\u4f8b\u5982\u4f7f\u7528\n```plaintext\n_FORTIFY_SOURCE\n```\n\u5374\u6ca1\u6709\n```plaintext\n-O1\n```\n\u6216\u66f4\u9ad8\u7684\u4f18\u5316\u7ea7\u522b\uff09\u800c\u88ab\u964d\u7ea7\u6216\u5173\u95ed\u65f6\uff0cGCC \u4f1a\u53d1\u51fa\u8b66\u544a\uff1a\n\n```\nwarning: '-fstack-protector-strong' is not enabled by '-fhardened' because it was specified on the command line [-Whardened]`\nwarning: '_FORTIFY_SOURCE' is not enabled by '-fhardened' because optimizations are turned off [-Whardened]\n```\n\n\u8fd9\u4e9b\u8b66\u544a\u53ef\u4ee5\u901a\u8fc7\n```plaintext\n-Whardened\n```\n\u9009\u9879\u663e\u5f0f\u63a7\u5236\u3002\n\n* * *\n\n### \u5141\u8bb8\u94fe\u63a5\u5668\u7701\u7565\u547d\u4ee4\u884c\u4e0a\u6307\u5b9a\u8981\u94fe\u63a5\u3001\u4f46\u5b9e\u9645\u672a\u88ab\u4f7f\u7528\u7684\u5e93\n\n- **`-Wl,--as-needed`**\uff08Binutils 2.20.0\uff09\uff1a\u5141\u8bb8\u94fe\u63a5\u5668\u7701\u7565\u547d\u4ee4\u884c\u4e0a\u6307\u5b9a\u8981\u94fe\u63a5\u3001\u4f46\u5b9e\u9645\u672a\u88ab\u4f7f\u7528\u7684\u5e93\u3002\n- **`-Wl,--no-copy-dt-needed-entries`**\uff08Binutils 2.20.0\uff09\uff1a\u963b\u6b62\u94fe\u63a5\u5668\u628a\u751f\u6210\u4e8c\u8fdb\u5236\u4e2d\u7684\u7b26\u53f7\u89e3\u6790\u5230\u4f20\u9012\u4f9d\u8d56\u4e0a\u3002\n\n### \u6982\u8ff0\n\n```plaintext\n--as-needed\n```\n\u9009\u9879\u544a\u8bc9 GNU \u94fe\u63a5\u5668\u53ea\u94fe\u63a5\u90a3\u4e9b\u5305\u542b\u751f\u6210\u4e8c\u8fdb\u5236\u5b9e\u9645\u6240\u7528\u7b26\u53f7\u7684\u5e93\u3002\u8fd9\u6709\u52a9\u4e8e\u628a\u751f\u6210\u4e8c\u8fdb\u5236\u7684\u653b\u51fb\u9762\u964d\u5230\u6700\u5c0f\uff1a\u963b\u6b62\u6267\u884c\u4e0d\u5fc5\u8981\u5e93\u4e2d\u7684\u9759\u6001\u521d\u59cb\u5316\u5668\u4e0e\u6790\u6784\u5668\uff0c\u5e76\u4e14\u8fd8\u80fd\u51cf\u5c11\u53ef\u4f9b\u4ee3\u7801\u590d\u7528\u6f0f\u6d1e\u5229\u7528\uff08\u4f8b\u5982\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff09\u4f7f\u7528\u7684\u4ee3\u7801\u96c6\u5408\u3002\n\n```plaintext\n--as-needed\n```\n\u9009\u9879\u5728\u8bb8\u591a Linux \u53d1\u884c\u7248\u4e2d\u9ed8\u8ba4\u542f\u7528\uff0c\u5305\u62ec Debian [119]\u3001Gentoo [120]\u3001Red Hat [21] \u4e0e SUSE Linux [119]\u3002\n\n```plaintext\n--no-copy-dt-needed-entries\n```\n\u963b\u6b62\u94fe\u63a5\u5668\u628a\u751f\u6210\u4e8c\u8fdb\u5236\u4e2d\u7684\u7b26\u53f7\u89e3\u6790\u5230\u4f20\u9012\u6027\u7684\u5e93\u4f9d\u8d56\u4e0a\u3002\u8fd9\u5f3a\u5236\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u5fc5\u987b\u663e\u5f0f\u94fe\u63a5\u5176\u6240\u6709\u5b9e\u9645\u4f9d\u8d56\u3002\u8fd9\u662f GNU \u94fe\u63a5\u5668\u81ea 2.22 \u8d77\u7684\u9ed8\u8ba4\u884c\u4e3a\u3002\n\n### \u6027\u80fd\u5f71\u54cd\n\n```plaintext\n--as-needed\n```\n\u4e0e\n```plaintext\n--no-copy-dt-needed-entries\n```\n\u53ef\u4ee5\u901a\u8fc7\u907f\u514d\u52a0\u8f7d\u4e0d\u9700\u8981\u7684\u5e93\u3001\u907f\u514d\u6267\u884c\u8fd9\u4e9b\u5e93\u4e2d\u7684\u521d\u59cb\u5316\u4ee3\u7801\uff0c\u6765\u6539\u5584\u542f\u52a8\u65f6\u95f4\u3002\n\n### \u4f55\u65f6\u4e0d\u8981\u4f7f\u7528\uff1f\n\n\u5728\u5c11\u6570\u60c5\u51b5\u4e0b\uff0c\u5e94\u7528\u7a0b\u5e8f\u94fe\u63a5\u67d0\u4e2a\u5e93\u7684\u76ee\u7684\u4ec5\u4ec5\u662f\u4e3a\u4e86\u8fd0\u884c\u5176\u9759\u6001\u521d\u59cb\u5316\u5668\u3002\u7531\u4e8e\n```plaintext\n--as-needed\n```\n\u4f1a\u963b\u6b62\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u4e0e\u672a\u4ece\u5176\u4e2d\u89e3\u6790\u51fa\u4efb\u4f55\u7b26\u53f7\u7684\u5e93\u5efa\u7acb\u94fe\u63a5\uff0c\u56e0\u6b64\u5b83\u4e0e\u4f9d\u8d56\u6b64\u7c7b\u9759\u6001\u521d\u59cb\u5316\u7684\u8f6f\u4ef6\u51b2\u7a81 [121]\u3002\n\n* * *\n\n### \u4fdd\u8bc1\u81ea\u52a8\u53d8\u91cf\u521d\u59cb\u5316\u5668\u4e2d\u586b\u5145\u4f4d\u7684\u96f6\u521d\u59cb\u5316\n\n- **`-fzero-init-padding-bits=all`**\uff08GCC 15.0.0\uff09\uff1a\u4fdd\u8bc1\u6240\u6709\u81ea\u52a8\u53d8\u91cf\u521d\u59cb\u5316\u5668\u4e2d\u7684\u586b\u5145\u4f4d\u88ab\u96f6\u521d\u59cb\u5316\u3002\n- **`-fzero-init-padding-bits=union`**\uff08GCC 15.0.0\uff09\uff1a\u5728\u6807\u51c6\u6240\u4fdd\u8bc1\u7684\u8303\u56f4\u4e4b\u5916\uff0c\u989d\u5916\u4fdd\u8bc1\u8054\u5408\u4f53\u4e2d\u7684\u586b\u5145\u4f4d\u88ab\u96f6\u521d\u59cb\u5316\u3002\n\n### \u6982\u8ff0\n\nGCC \u4e2d\u7684\n```plaintext\n-fzero-init-padding-bits=all\n```\n\u9009\u9879\u4fdd\u8bc1\u7ed3\u6784\u4f53\u4e0e\u8054\u5408\u4f53\u7684\u586b\u5145\u4f4d\u88ab\u96f6\u521d\u59cb\u5316\uff0c\u964d\u4f4e\u4e0d\u5b8c\u6574\u521d\u59cb\u5316\u6cc4\u9732\u654f\u611f\u4fe1\u606f\u7684\u98ce\u9669\u3002\n\n\u6211\u4eec\u5efa\u8bae\u5bf9\u8054\u5408\u4f53\u4f7f\u7528\n```plaintext\n{}\n```\n\u521d\u59cb\u5316\u5668\uff0c\u56e0\u4e3a\u5728 C23 \u4e0e C++ \u6807\u51c6\u4e2d\uff0c\u8fd9\u662f\u96f6\u521d\u59cb\u5316\u6574\u4e2a\u8054\u5408\u4f53\uff08\u5305\u62ec\u5176\u586b\u5145\u4f4d\uff09\u7684\u5408\u89c4\u65b9\u5f0f\u3002\u7136\u800c\u8f83\u65e7\u7684\u4ee3\u7801\u53ef\u80fd\u4f7f\u7528\u522b\u7684\u505a\u6cd5\uff0c\u6709\u4e9b\u7f16\u8bd1\u5668\u53ef\u80fd\u4e0d\u652f\u6301\u5b83\uff0c\u5f00\u53d1\u8005\u6709\u65f6\u4e5f\u4f1a\u72af\u9519\uff0c\u56e0\u6b64\u8fd9\u4e2a\u9009\u9879\u53ef\u4ee5\u964d\u4f4e\u6b64\u7c7b\u95ee\u9898\u7684\u98ce\u9669\u3002\n\n\u81ea\u7b2c 15 \u7248\u8d77\uff0cGCC \u5bf9\u7ed3\u6784\u4f53\u4e0e\u8054\u5408\u4f53\u521d\u59cb\u5316\u5668\u91c7\u7528\u4e86\u66f4\u4e25\u683c\u4e14\u5408\u89c4\u7684\u5b9e\u73b0 [15]\u3002\u5728 GCC 14 \u53ca\u4e4b\u524d\uff0c\n```plaintext\n{0}\n```\n\u521d\u59cb\u5316\u5668\u4f1a\u96f6\u521d\u59cb\u5316\u6574\u4e2a\u8054\u5408\u4f53\u3002\u4ece GCC 15 \u8d77\uff0cC \u6216 C++ \u4e2d\u5bf9\u8054\u5408\u4f53\u4f7f\u7528\n```plaintext\n{0}\n```\n\u521d\u59cb\u5316\u5668\u4e0d\u518d\u4fdd\u8bc1\u6e05\u7a7a\u6574\u4e2a\u8054\u5408\u4f53\uff08\u9759\u6001\u5b58\u50a8\u671f\u521d\u59cb\u5316\u9664\u5916\uff09\uff0c\u53ea\u6709\u7b2c\u4e00\u4e2a\u8054\u5408\u4f53\u6210\u5458\u88ab\u521d\u59cb\u5316\u4e3a\u96f6\u3002GCC 15 \u4e2d\u7684\n```plaintext\n-fzero-init-padding-bits=union\n```\n\u9009\u9879\u6062\u590d\u4e86 GCC \u65e7\u6709\u7684\u884c\u4e3a\u3002\n\n* * *\n\n## \u4e0d\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u9009\u9879\n\n\u672c\u8282\u4ecb\u7ecd\u4e0d\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u4e0e\u94fe\u63a5\u5668\u9009\u9879\uff0c\u5b83\u4eec\u53ef\u80fd\u5728\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u4e2d\u5f15\u5165\u5e26\u5b89\u5168\u9690\u60a3\u7684\u6f5c\u5728\u7f3a\u9677\u3002\n\n\u8868 3\uff1a\u4e0d\u63a8\u8350\u7684\u7f16\u8bd1\u5668\u4e0e\u94fe\u63a5\u5668\u9009\u9879\u5217\u8868\u3002\n\n- **`-Wl,-rpath,` _`path_to_so`_**\uff08Binutils 2.11.0\uff09\uff1a\u5728\u53ef\u6267\u884c\u6587\u4ef6\u6216\u5e93\u4e2d\u786c\u7f16\u7801\u8fd0\u884c\u65f6\u641c\u7d22\u8def\u5f84\u3002\n\n* * *\n\n### \u5728\u53ef\u6267\u884c\u6587\u4ef6\u6216\u5e93\u4e2d\u786c\u7f16\u7801\u8fd0\u884c\u65f6\u641c\u7d22\u8def\u5f84\n\n- **`-Wl,-rpath,` _`path_to_so`_**\uff08Binutils 2.11.0\uff09\uff1a\u5728\u53ef\u6267\u884c\u6587\u4ef6\u6216\u5e93\u4e2d\u786c\u7f16\u7801\u8fd0\u884c\u65f6\u641c\u7d22\u8def\u5f84\u3002\n\n### \u6982\u8ff0\n\n```plaintext\n-rpath\n```\n\u9009\u9879\u628a\u6307\u5b9a\u7684\u5171\u4eab\u5bf9\u8c61\u6587\u4ef6\u8def\u5f84\u8bb0\u5f55\u5230\u751f\u6210 ELF \u4e8c\u8fdb\u5236\u7684\n```plaintext\nDT_RPATH\n```\n\u6216\n```plaintext\nDT_RUNPATH\n```\n\u5934\u90e8\u503c\u4e2d\u3002\u6240\u8bb0\u5f55\u7684 rpath \u53ef\u80fd\u8986\u76d6\u6216\u8865\u5145\u52a8\u6001\u94fe\u63a5\u5668\u7528\u6765\u67e5\u627e\u6307\u5b9a\u5e93\u4f9d\u8d56\u7684\u7cfb\u7edf\u9ed8\u8ba4\u641c\u7d22\u8def\u5f84\u3002\n\n\u7531\u539f\u59cb\u7684\uff08\u4e5f\u662f\u9ed8\u8ba4\u7684\uff09\n```plaintext\nDT_RPATH\n```\n\u6761\u76ee\u63d0\u4f9b\u7684 rpath \u4f18\u5148\u4e8e\n```plaintext\nLD_LIBRARY_PATH\n```\n\u4e4b\u7c7b\u73af\u5883\u53d8\u91cf\u8986\u76d6\uff0c\u800c\u4e14\u4e00\u4e2a\u5bf9\u8c61\u7684\n```plaintext\nDT_RPATH\n```\n\u53ef\u7528\u4e8e\u89e3\u6790\u53e6\u4e00\u4e2a\u5bf9\u8c61\u7684\u4f9d\u8d56\u3002\u8fd9\u4e9b\u8bbe\u8ba1\u5931\u8bef\u5df2\u7531\n```plaintext\nDT_RUNPATH\n```\n\u7ea0\u6b63\uff0c\u540e\u8005\u76f8\u5bf9\n```plaintext\nLD_LIBRARY_PATH\n```\n\u4f18\u5148\u7ea7\u66f4\u4f4e\uff0c\u5e76\u4e14\u53ea\u5f71\u54cd\u5bf9\u8c61\u81ea\u8eab\u76f4\u63a5\u4f9d\u8d56\u7684\u641c\u7d22\u8def\u5f84 [122]\u3002\n\n\u5728\u53d1\u5e03\u4e8c\u8fdb\u5236\u4e2d\u8bbe\u7f6e\n```plaintext\nDT_RPATH\n```\n\u6216\n```plaintext\nDT_RUNPATH\n```\n\uff0c\u5728\u67d0\u4e9b\u6761\u4ef6\u4e0b\u53ef\u80fd\u5bfc\u81f4\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u80fd\u80fd\u591f\u5728\u76ee\u6807\u76ee\u5f55\u4e2d\u63d0\u4f9b\u81ea\u5df1\u7684\u5171\u4eab\u6587\u4ef6\u5e76\u8986\u76d6\u64cd\u4f5c\u7cfb\u7edf\u7684\u5e93\uff0c\u4ece\u800c\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\n\n\u76f8\u5bf9\u8def\u5f84\uff08\u4f8b\u5982\n```plaintext\n.\n```\n\u6216\n```plaintext\n./lib\n```\n\uff09\u662f\u76f8\u5bf9\u4e8e\u5de5\u4f5c\u76ee\u5f55\u89e3\u6790\u7684\uff0c\u800c\u5de5\u4f5c\u76ee\u5f55\u53ef\u80fd\u88ab\u653b\u51fb\u8005\u8bbe\u7f6e\u4e3a\u542b\u6709\u6076\u610f\u4f9d\u8d56\u7684\u76ee\u5f55\u3002\n\nrpath \u4e2d\u7684\n```plaintext\n$ORIGIN\n```\n\u5173\u952e\u5b57\u4f1a\u88ab\u52a8\u6001\u52a0\u8f7d\u5668\u5c55\u5f00\u4e3a\u627e\u5230\u8be5\u5bf9\u8c61\u6240\u5728\u76ee\u5f55\u7684\u8def\u5f84\uff0c\u800c\u8be5\u76ee\u5f55\u53ef\u80fd\u88ab\u653b\u51fb\u8005\uff08\u4f8b\u5982\u901a\u8fc7\u786c\u94fe\u63a5\uff09\u8bbe\u7f6e\u4e3a\u542b\u6709\u6076\u610f\u4f9d\u8d56\u7684\u76ee\u5f55\u3002\u5728 Linux \u4e0a\uff0c\n```plaintext\nfs.protected_hardlinks\n```\nsysctl \u6709\u52a9\u4e8e\u9632\u6b62\u8fd9\u79cd\u653b\u51fb\u3002\n\n\u5728 setuid/setgid \u7a0b\u5e8f\u4e2d\u8bbe\u7f6e rpath\uff0c\u53ef\u80fd\u5bfc\u81f4\u6743\u9650\u63d0\u5347\u2014\u2014\u5f53\u901a\u8fc7\u8bbe\u5b9a\u7684 rpath \u52a0\u8f7d\u7684\u4e0d\u53ef\u4fe1\u5e93\u4f5c\u4e3a\u7279\u6743\u7a0b\u5e8f\u7684\u4e00\u90e8\u5206\u88ab\u6267\u884c\u65f6\u3002\u867d\u7136 setuid/setgid \u4e8c\u8fdb\u5236\u4f1a\u5ffd\u7565\u5bf9\u641c\u7d22\u8def\u5f84\u7684\u73af\u5883\u8986\u76d6\uff08\u4f8b\u5982\n```plaintext\nLD_PRELOAD\n```\n\u3001\n```plaintext\nLD_LIBRARY_PATH\n```\n\u7b49\uff09\uff0c\u4f46\u6b64\u7c7b\u4e8c\u8fdb\u5236\u5185\u90e8\u7684 rpath \u5374\u80fd\u7ed9\u653b\u51fb\u8005\u63d0\u4f9b\u64cd\u7eb5\u4f9d\u8d56\u641c\u7d22\u8def\u5f84\u7684\u7b49\u6548\u80fd\u529b\u3002\n\n* * *\n\n## Sanitizer\n\nSanitizer \u662f\u4e00\u5957\u57fa\u4e8e\u7f16\u8bd1\u5668\u7684\u5de5\u5177\uff0c\u7528\u4e8e\u68c0\u6d4b\u5e76\u7cbe\u786e\u5b9a\u4f4d\u7528 C \u4e0e C++ \u7f16\u5199\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u5185\u5b58\u5b89\u5168\u95ee\u9898\u53ca\u5176\u4ed6\u7f3a\u9677\u3002\u5b83\u4eec\u63d0\u4f9b\u4e0e\u57fa\u4e8e Valgrind \u7b49\u6846\u67b6\u7684\u52a8\u6001\u5206\u6790\u5de5\u5177\u7c7b\u4f3c\u7684\u80fd\u529b\u3002\u4f46\u4e0e Valgrind \u4e0d\u540c\uff0cSanitizer \u5229\u7528\u7f16\u8bd1\u671f\u63d2\u6869\u6765\u62e6\u622a\u5e76\u76d1\u89c6\u5185\u5b58\u8bbf\u95ee\u3002\u8fd9\u4f7f Sanitizer \u76f8\u6bd4\u52a8\u6001\u5206\u6790\u5668\u66f4\u9ad8\u6548\u3001\u66f4\u51c6\u786e\u3002\u5e73\u5747\u800c\u8a00\uff0cSanitizer \u4f1a\u4f7f\u63d2\u6869\u540e\u7684\u4e8c\u8fdb\u5236\u53d8\u6162 2 \u5230 4 \u500d\uff0c\u800c\u52a8\u6001\u63d2\u6869\u7684\u51cf\u901f\u53ef\u9ad8\u8fbe 20 \u5230 50 \u500d [123]\u3002\u4f5c\u4e3a\u6743\u8861\uff0cSanitizer \u5fc5\u987b\u5728\u7f16\u8bd1\u671f\u542f\u7528\uff0c\u800c Valgrind \u53ef\u7528\u4e8e\u672a\u7ecf\u4fee\u6539\u7684\u4e8c\u8fdb\u5236\u3002\u8868 4 \u5217\u51fa GCC \u4e0e Clang \u652f\u6301\u7684 Sanitizer \u9009\u9879\u3002\n\n\u867d\u7136\u6bd4\u52a8\u6001\u5206\u6790\u66f4\u9ad8\u6548\uff0c\u4f46\u5c31\u6027\u80fd\u635f\u5931\u4e0e\u5185\u5b58\u5f00\u9500\u800c\u8a00\uff0cSanitizer \u5bf9\u4e8e\u53d1\u5e03\uff08Release\uff09\u6784\u5efa\u4ecd\u7136\u6602\u8d35\u5230\u4e0d\u53ef\u63a5\u53d7\uff0c\u4e0d\u8fc7\u5728\u8c03\u8bd5\uff08Debug\uff09\u6784\u5efa\u4ee5\u53ca\u67d0\u4e9b\u60c5\u51b5\u4e0b\u7684\u6d4b\u8bd5\uff08Test\uff09\u6784\u5efa\u4e2d\uff0c\u5b83\u4eec\u5728\u63d0\u4f9b\u5185\u5b58\u8bca\u65ad\u65b9\u9762\u8868\u73b0\u4f18\u5f02\u3002\u4f8b\u5982\uff0c\u6a21\u7cca\u6d4b\u8bd5\uff08fuzz testing\uff0c\u6216\u201cfuzzing\u201d\uff09\u662f\u4e00\u9879\u5e38\u89c1\u7684\u5b89\u5168\u4fdd\u969c\u6d3b\u52a8\uff0c\u65e8\u5728\u627e\u51fa\u89e6\u53d1\u5185\u5b58\u76f8\u5173\u7f3a\u9677\u7684\u6761\u4ef6\u3002\u6a21\u7cca\u6d4b\u8bd5\u4e3b\u8981\u7528\u4e8e\u53d1\u73b0\u5bfc\u81f4\u5e94\u7528\u5d29\u6e83\u7684\u5185\u5b58\u9519\u8bef\u3002\u7136\u800c\uff0c\u82e5\u5728\u914d\u5907 Sanitizer \u529f\u80fd\u7684\u4e8c\u8fdb\u5236\u4e0a\u505a\u6a21\u7cca\u6d4b\u8bd5\uff0c\u8fd8\u53ef\u80fd\u53d1\u73b0\u4e0d\u4f1a\u5bfc\u81f4\u5e94\u7528\u5d29\u6e83\u7684\u7f3a\u9677\u3002\u53e6\u4e00\u4e2a\u597d\u5904\u662f Sanitizer \u751f\u6210\u7684\u589e\u5f3a\u8bca\u65ad\u4fe1\u606f\u3002\n\n\u4e0e\u6240\u6709\u6d4b\u8bd5\u5b9e\u8df5\u4e00\u6837\uff0cSanitizer \u65e0\u6cd5\u7edd\u5bf9\u8bc1\u660e\u7f3a\u9677\u4e0d\u5b58\u5728\u3002\u7136\u800c\uff0c\u82e5\u6070\u5f53\u4e14\u5b9a\u671f\u4f7f\u7528\uff0c\u5b83\u4eec\u6709\u52a9\u4e8e\u53d1\u73b0\u90a3\u4e9b\u53ef\u80fd\u96be\u4ee5\u7cbe\u786e\u5b9a\u4f4d\u7684\u6f5c\u5728\u5185\u5b58\u3001\u5e76\u53d1\u4e0e\u672a\u5b9a\u4e49\u884c\u4e3a\u76f8\u5173\u7f3a\u9677\u3002\n\nSanitizer \u4e0d\u5e94\u5728\u751f\u4ea7\u73af\u5883\u4e2d\u7528\u4e8e\u52a0\u56fa\uff08Clang \u4e2d\u53ef\u7528\n```plaintext\n-fsanitize-minimal-runtime\n```\n\uff0c\u5728 GCC \u4e2d\u53ef\u7528\n```plaintext\n-fsanitize-trap=undefined\n```\n\u542f\u7528\u5e26\u6700\u5c0f\u8fd0\u884c\u65f6\u7684 UndefinedBehaviorSanitizer \u7684\u60c5\u51b5\u9664\u5916\uff09\uff0c\u5c24\u5176\u662f Set User ID\uff08SUID\uff09\u4e8c\u8fdb\u5236\uff0c\u56e0\u4e3a\u5b83\u4eec\u901a\u8fc7\u73af\u5883\u53d8\u91cf\u66b4\u9732\u8fd0\u884c\u53c2\u6570\uff0c\u800c\u8fd9\u4e9b\u53c2\u6570\u53ef\u88ab\u64cd\u7eb5\u4ee5\u8986\u76d6 root \u62e5\u6709\u7684\u6587\u4ef6\u5e76\u63d0\u5347\u6743\u9650 [124]\u3002\n\n\u8868 4\uff1aGCC \u4e0e Clang \u4e2d\u7684 Sanitizer \u9009\u9879\u3002\n\n- **`-fsanitize=address`**\uff08GCC 4.8.0\u3001Clang 3.1.0\uff09\uff1a\u542f\u7528 AddressSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u5185\u5b58\u9519\u8bef\n- **`-fsanitize=thread`**\uff08GCC 4.8.0\u3001Clang 3.2.0\uff09\uff1a\u542f\u7528 ThreadSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u6570\u636e\u7ade\u4e89\u7f3a\u9677\n- **`-fsanitize=leak`**\uff08GCC 4.8.0\u3001Clang 3.1.0\uff09\uff1a\u542f\u7528 LeakSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u5185\u5b58\u6cc4\u6f0f\n- **`-fsanitize=undefined`**\uff08GCC 4.9.0\u3001Clang 3.3.0\uff09\uff1a\u542f\u7528 UndefinedBehaviorSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u672a\u5b9a\u4e49\u884c\u4e3a\n\n* * *\n\n### AddressSanitizer\n\n- **`-fsanitize=address`**\uff08GCC 4.8.0\u3001Clang 3.1.0\uff09\uff1a\u542f\u7528 AddressSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u5185\u5b58\u9519\u8bef\u3002\n\nAddressSanitizer\uff08ASan\uff09\u662f\u4e00\u4e2a\u5185\u5b58\u9519\u8bef\u68c0\u6d4b\u5668\uff0c\u53ef\u8bc6\u522b\u6d89\u53ca\u4ee5\u4e0b\u60c5\u5f62\u7684\u5185\u5b58\u7f3a\u9677\uff1a\n\n*   \u6808\u4e0a\u3001\u5806\u4e0a\u4ee5\u53ca\u5168\u5c40\u53d8\u91cf\u4e2d\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\n*   \u91ca\u653e\u540e\u4f7f\u7528\uff08\u89e3\u5f15\u7528\u60ac\u5782\u6307\u9488\uff09\n*   \u8fd4\u56de\u540e\u4f7f\u7528\uff08\u51fd\u6570\u8fd4\u56de\u540e\u4f7f\u7528\u4e3a\u5c40\u90e8\u53d8\u91cf\u4fdd\u7559\u7684\u6808\u5185\u5b58\uff09\n*   \u4f5c\u7528\u57df\u5916\u4f7f\u7528\uff08\u5728\u53d8\u91cf\u7684\u8bcd\u6cd5\u4f5c\u7528\u57df\u4e4b\u5916\u4f7f\u7528\u5176\u6808\u5730\u5740\uff09\n*   \u521d\u59cb\u5316\u987a\u5e8f\u7f3a\u9677\n*   \u5185\u5b58\u6cc4\u6f0f\uff08\u53e6\u89c1\u4e0b\u6587 LeakSanitizer \u4e00\u8282\uff09\n\n\u8981\u542f\u7528 ASan\uff0c\u628a\n```plaintext\n-fsanitize=address\n```\n\u52a0\u5165\u7f16\u8bd1\u5668\u9009\u9879\uff08C \u7528\n```plaintext\nCFLAGS\n```\n\uff0cC++ \u7528\n```plaintext\nCXXFLAGS\n```\n\uff09\u4e0e\u94fe\u63a5\u5668\u9009\u9879\uff08\n```plaintext\nLDFLAGS\n```\n\uff09\u3002\u5efa\u8bae\u628a ASan \u4e0e\u4e0b\u5217\u7f16\u8bd1\u5668\u9009\u9879\u914d\u5408\uff1a\n\n*   `-O1`\uff08\u7981\u7528\u5185\u8054\u5e76\u6539\u5584\u6808\u56de\u6eaf\uff0c\u66f4\u9ad8\u7ea7\u522b\u4f1a\u6539\u5584\u6027\u80fd\uff09\n*   `-g`\uff08\u5728\u6240\u751f\u6210\u7684\u9519\u8bef\u6d88\u606f\u4e2d\u663e\u793a\u6e90\u6587\u4ef6\u540d\u4e0e\u884c\u53f7\uff09\n*   `-fno-omit-frame-pointer`\uff08\u8fdb\u4e00\u6b65\u6539\u5584\u6808\u56de\u6eaf\uff09\n*   `-fno-optimize-sibling-calls`\uff08\u7981\u7528\u5c3e\u8c03\u7528\u4f18\u5316\uff09\n*   `-fno-common`\uff08\u7981\u7528\u516c\u5171\u7b26\u53f7\u4ee5\u6539\u5584\u5bf9\u5168\u5c40\u53d8\u91cf\u7684\u8ddf\u8e2a\uff09\n\nASan \u7684\u8fd0\u884c\u65f6\u884c\u4e3a\u53ef\u4ee5\u901a\u8fc7\n```plaintext\nASAN_OPTIONS\n```\n\u73af\u5883\u53d8\u91cf\u8c03\u6574\u3002\u8fd0\u884c\u65f6\u9009\u9879\u53ef\u7528\u4e8e\u542f\u7528\u989d\u5916\u7684\u5185\u5b58\u9519\u8bef\u68c0\u67e5\u5e76\u8c03\u6574 ASan \u6027\u80fd\u3002\u53d7\u652f\u6301\u9009\u9879\u7684\u6700\u65b0\u5217\u8868\u89c1\u9879\u76ee GitHub Wiki \u4e0a\u7684 AddressSanitizerFlags \u6587\u7ae0 [125]\u3002\u82e5\u8bbe\u4e3a\n```plaintext\nASAN_OPTIONS=help=1\n```\n\uff0c\u63d2\u6869\u7a0b\u5e8f\u542f\u52a8\u65f6\u4f1a\u663e\u793a\u53ef\u7528\u9009\u9879\u3002\u8fd9\u5bf9\u4e8e\u786e\u5b9a\u6240\u7528\u7f16\u8bd1\u5668\u96c6\u6210\u7684\u8be5 ASan \u7248\u672c\u652f\u6301\u54ea\u4e9b\u9009\u9879\u7279\u522b\u6709\u7528\u3002\u4e0b\u9762\u7ed9\u51fa\u4e00\u7ec4\u6bd4\u9ed8\u8ba4\u884c\u4e3a\u66f4\u6fc0\u8fdb\u7684\u8bca\u65ad\u9884\u8bbe\uff1a\n\n```\nASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1: \\\ncheck_initialization_order=1:strict_init_order=1 ./instrumented-executable\n```\n\n\u5f53 ASan \u9047\u5230\u5185\u5b58\u9519\u8bef\u65f6\uff0c\uff08\u9ed8\u8ba4\uff09\u4f1a\u7ec8\u6b62\u5e94\u7528\uff0c\u5e76\u6253\u5370\u9519\u8bef\u6d88\u606f\u4e0e\u6808\u56de\u6eaf\uff0c\u63cf\u8ff0\u6240\u68c0\u6d4b\u9519\u8bef\u7684\u6027\u8d28\u4e0e\u4f4d\u7f6e\u3002ASan \u62a5\u544a\u7684\u4e0d\u540c\u9519\u8bef\u7c7b\u578b\u53ca\u5176\u5bf9\u5e94\u6839\u56e0\u7684\u7cfb\u7edf\u6027\u8bf4\u660e\uff0c\u89c1\u9879\u76ee GitHub Wiki \u4e0a\u7684 AddressSanitizer \u6587\u7ae0 [126]\u3002\n\nASan \u4e0d\u80fd\u4e0e ThreadSanitizer \u540c\u65f6\u4f7f\u7528\u3002GCC \u751f\u6210\u7684 ASan \u63d2\u6869\u4ee3\u7801\u4e0e Clang \u751f\u6210\u7684 ASan \u63d2\u6869\u4ee3\u7801\u65e0\u6cd5\u6df7\u7528\uff0c\u56e0\u4e3a GCC \u4e0e Clang \u4e2d\u7684 ASan \u5b9e\u73b0\u4e92\u4e0d\u517c\u5bb9\u3002\n\n\u6b64\u5916\uff0c\u5df2\u77e5 ASan \u82e5\u4e0e\n```plaintext\n-D_FORTIFY_SOURCE\n```\n\u7ec4\u5408\u4f1a\u6f0f\u62a5 [63]\u3002\n\n* * *\n\n### ThreadSanitizer\n\n- **`-fsanitize=thread`**\uff08GCC 4.8.0\u3001Clang 3.2.0\uff09\uff1a\u542f\u7528 ThreadSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u6570\u636e\u7ade\u4e89\u7f3a\u9677\u3002\n\nThreadSanitizer\uff08TSan\uff09\u662f\u9762\u5411 C/C++ \u7684\u6570\u636e\u7ade\u4e89\u68c0\u6d4b\u5668\u3002\u5f53\u540c\u4e00\u8fdb\u7a0b\u7684\u4e24\u4e2a\uff08\u6216\u66f4\u591a\uff09\u7ebf\u7a0b\u5728\u65e0\u540c\u6b65\u7684\u60c5\u51b5\u4e0b\u5e76\u53d1\u8bbf\u95ee\u540c\u4e00\u5185\u5b58\u4f4d\u7f6e\u65f6\uff0c\u5c31\u53d1\u751f\u4e86\u6570\u636e\u7ade\u4e89\u3002\u82e5\u5176\u4e2d\u81f3\u5c11\u4e00\u6b21\u8bbf\u95ee\u662f\u5199\uff0c\u5e94\u7528\u5c31\u6709\u8fdb\u5165\u4e0d\u4e00\u81f4\u5185\u90e8\u72b6\u6001\u7684\u98ce\u9669\u3002\u82e5\u4e24\u4e2a\u6216\u66f4\u591a\u7ebf\u7a0b\u8bd5\u56fe\u540c\u65f6\u5199\u540c\u4e00\u5185\u5b58\u4f4d\u7f6e\uff0c\u6570\u636e\u7ade\u4e89\u53ef\u80fd\u5bfc\u81f4\u5185\u5b58\u7834\u574f\u3002\u6570\u636e\u7ade\u4e89\u8c03\u8bd5\u8d77\u6765\u51fa\u4e86\u540d\u5730\u56f0\u96be\uff0c\u56e0\u4e3a\u8bbf\u95ee\u987a\u5e8f\u901a\u5e38\u4e0d\u786e\u5b9a\uff0c\u4e14\u53d6\u51b3\u4e8e\u51fa\u9519\u7ebf\u7a0b\u4e2d\u4e8b\u4ef6\u7684\u7cbe\u786e\u65f6\u5e8f\u3002\n\n\u8981\u542f\u7528 TSan\uff0c\u628a\n```plaintext\n-fsanitize=thread\n```\n\u52a0\u5165\u7f16\u8bd1\u5668\u9009\u9879\uff08C \u7528\n```plaintext\nCFLAGS\n```\n\uff0cC++ \u7528\n```plaintext\nCXXFLAGS\n```\n\uff09\u4e0e\u94fe\u63a5\u5668\u9009\u9879\uff08\n```plaintext\nLDFLAGS\n```\n\uff09\u3002\u5efa\u8bae\u628a TSan \u4e0e\u4e0b\u5217\u7f16\u8bd1\u5668\u9009\u9879\u914d\u5408\uff1a\n\n*   `-O2`\uff08\u6216\u66f4\u9ad8\u7ea7\u522b\uff0c\u4ee5\u83b7\u5f97\u5408\u7406\u6027\u80fd\uff09\n*   `-g`\uff08\u5728\u6240\u751f\u6210\u7684\u8b66\u544a\u6d88\u606f\u4e2d\u663e\u793a\u6e90\u6587\u4ef6\u540d\u4e0e\u884c\u53f7\uff09\n\nTSan \u7684\u8fd0\u884c\u65f6\u884c\u4e3a\u53ef\u4ee5\u901a\u8fc7\n```plaintext\nTSAN_OPTIONS\n```\n\u73af\u5883\u53d8\u91cf\u8c03\u6574\u3002\u53d7\u652f\u6301\u9009\u9879\u7684\u6700\u65b0\u5217\u8868\u89c1\u9879\u76ee GitHub Wiki \u4e0a\u7684 ThreadSanitizerFlags \u6587\u7ae0 [127]\u3002\u82e5\u8bbe\u4e3a\n```plaintext\nTSAN_OPTIONS=help=1\n```\n\uff0c\u63d2\u6869\u7a0b\u5e8f\u542f\u52a8\u65f6\u4f1a\u663e\u793a\u53ef\u7528\u9009\u9879\u3002\n\n\u5f53 TSan \u9047\u5230\u6f5c\u5728\u7684\u6570\u636e\u7ade\u4e89\u65f6\uff0c\uff08\u9ed8\u8ba4\uff09\u4f1a\u901a\u8fc7\u6253\u5370\u4e00\u6761\u8b66\u544a\u6d88\u606f\u6765\u62a5\u544a\uff0c\u5176\u4e2d\u63cf\u8ff0\u5bfc\u81f4\u8be5\u6570\u636e\u7ade\u4e89\u7684\u7a0b\u5e8f\u72b6\u6001\u3002\u62a5\u544a\u683c\u5f0f\u7684\u8be6\u7ec6\u8bf4\u660e\u89c1\u9879\u76ee GitHub Wiki \u4e0a\u7684 ThreadSanitizerReportFormat \u6587\u7ae0 [128]\u3002\n\nTSan \u4e0d\u80fd\u4e0e AddressSanitizer\uff08ASan\uff09\u6216 LeakSanitizer\uff08LSan\uff09\u540c\u65f6\u4f7f\u7528\u3002GCC \u751f\u6210\u7684 TSan \u63d2\u6869\u4ee3\u7801\u4e0e Clang \u751f\u6210\u7684 TSan \u63d2\u6869\u4ee3\u7801\u65e0\u6cd5\u6df7\u7528\uff0c\u56e0\u4e3a GCC \u4e0e Clang \u4e2d\u7684 TSan \u5b9e\u73b0\u4e92\u4e0d\u517c\u5bb9\u3002TSan \u901a\u5e38\u8981\u6c42\u6240\u6709\u4ee3\u7801\u90fd\u4ee5\n```plaintext\n-fsanitize=thread\n```\n\u7f16\u8bd1\u624d\u80fd\u6b63\u786e\u5de5\u4f5c\u3002\n\n* * *\n\n### LeakSanitizer\n\n- **`-fsanitize=leak`**\uff08GCC 4.8.0\u3001Clang 3.1.0\uff09\uff1a\u542f\u7528 LeakSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u5185\u5b58\u6cc4\u6f0f\u3002\n\nLeakSanitizer\uff08LSan\uff09\u662f\u5185\u7f6e\u4e8e ASan \u7684\u5185\u5b58\u6cc4\u6f0f\u68c0\u6d4b\u7684\u72ec\u7acb\u7248\u672c\u3002\u5b83\u53ef\u4ee5\u5728\u6ca1\u6709 ASan \u6240\u5e26\u6765\u6027\u80fd\u635f\u5931\u7684\u60c5\u51b5\u4e0b\u5206\u6790\u5185\u5b58\u6cc4\u6f0f\u3002\u4e0e ASan \u4e0d\u540c\uff0cLSan \u4e0d\u9700\u8981\u7f16\u8bd1\u671f\u63d2\u6869\uff0c\u5b83\u53ea\u7531\u4e00\u4e2a\u8fd0\u884c\u65f6\u5e93\u7ec4\u6210\u3002\n```plaintext\n-fsanitize=leak\n```\n\u9009\u9879\u6307\u793a\u94fe\u63a5\u5668\u628a\u5e94\u7528\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\u94fe\u63a5\u5230 LSan \u5e93\uff0c\u8be5\u5e93\u4f1a\u8986\u76d6\n```plaintext\nmalloc()\n```\n\u53ca\u5176\u4ed6\u5206\u914d\u5668\u51fd\u6570\u3002\n\nLSan \u7684\u8fd0\u884c\u65f6\u884c\u4e3a\u53ef\u4ee5\u901a\u8fc7\n```plaintext\nLSAN_OPTIONS\n```\n\u73af\u5883\u53d8\u91cf\u8c03\u6574\u3002\u82e5\u8bbe\u4e3a\n```plaintext\nLSAN_OPTIONS=help=1\n```\n\uff0c\u7a0b\u5e8f\u542f\u52a8\u65f6\u4f1a\u663e\u793a\u53ef\u7528\u9009\u9879\u3002\n\nLSan \u4e0d\u80fd\u4e0e AddressSanitizer\uff08ASan\uff09\u6216 ThreadSanitizer\uff08TSan\uff09\u540c\u65f6\u4f7f\u7528\u3002\u82e5\u6784\u5efa\u65f6\u542f\u7528\u4e86 ASan \u6216 TSan\uff0c\u94fe\u63a5\u5668\u4f1a\u5ffd\u7565\n```plaintext\n-fsanitize=leak\n```\n\u9009\u9879\u3002\n\n* * *\n\n### UndefinedBehaviorSanitizer\n\n- **`-fsanitize=undefined`**\uff08GCC 4.9.0\u3001Clang 3.3.0\uff09\uff1a\u542f\u7528 UndefinedBehaviorSanitizer \u4ee5\u5728\u8fd0\u884c\u65f6\u68c0\u6d4b\u672a\u5b9a\u4e49\u884c\u4e3a\u3002\u9700\u8981 `-O1` \u6216\u66f4\u9ad8\u4f18\u5316\u7ea7\u522b\u3002\n- **`-fsanitize-minimal-runtime`**\uff08Clang 6.0.0\uff09\uff1a\u542f\u7528\u6700\u5c0f\u7684 UBSan \u8fd0\u884c\u65f6\uff0c\u800c\u975e Clang \u901a\u5e38\u4f7f\u7528\u7684 libubsan \u5e93\uff0c\u4ee5\u4fbf\u5728\u751f\u4ea7\u4ee3\u7801\u4e2d\u4f7f\u7528 UBSan\u3002\n- **`-fsanitize-trap=undefined`**\uff08GCC 13.1.0\uff09\uff1a\u542f\u7528 UBSan\uff0c\u4f46\u901a\u8fc7 `__builtin_trap` \u800c\u975e GCC \u901a\u5e38\u4f7f\u7528\u7684 libubsan \u8fd0\u884c\u65f6\u5e93\u6765\u62a5\u544a\u3002\u9700\u8981 `-O1` \u6216\u66f4\u9ad8\u4f18\u5316\u7ea7\u522b\u3002\n\nUndefinedBehaviorSanitizer\uff08UBSan\uff09\u7528\u4e8e\u68c0\u6d4b\u90a3\u4e9b\u4f1a\u5bfc\u81f4 ISO C \u6807\u51c6\u672a\u660e\u786e\u5b9a\u4e49\u7684\u884c\u4e3a\u7684\u4e0d\u53ef\u79fb\u690d\u6216\u9519\u8bef\u7684\u7a0b\u5e8f\u6784\u9020\u3002UBSan \u63d0\u4f9b\u5927\u91cf\u5b50\u9009\u9879\uff0c\u53ef\u5206\u522b\u542f\u7528/\u7981\u7528\u9488\u5bf9\u4e0d\u540c\u7c7b\u522b\u672a\u5b9a\u4e49\u884c\u4e3a\u7684\u68c0\u67e5\u3002\u53d7\u652f\u6301\u5b50\u9009\u9879\u7684\u6700\u65b0\u4fe1\u606f\u8bf7\u67e5\u9605 GCC [129] \u4e0e Clang [130] \u5404\u81ea\u7684\u6587\u6863\u3002\n\n\u8981\u542f\u7528 UBSan\uff0c\u628a\n```plaintext\n-fsanitize=undefined\n```\n\u4ee5\u53ca\u4efb\u4f55\u6240\u9700\u7684\u5b50\u9009\u9879\u52a0\u5165\u7f16\u8bd1\u5668\u9009\u9879\uff08C \u7528\n```plaintext\nCFLAGS\n```\n\uff0cC++ \u7528\n```plaintext\nCXXFLAGS\n```\n\uff09\u4e0e\u94fe\u63a5\u5668\u9009\u9879\uff08\n```plaintext\nLDFLAGS\n```\n\uff09\u3002\u5efa\u8bae\u628a UBSan \u4e0e\u4e0b\u5217\u7f16\u8bd1\u5668\u9009\u9879\u914d\u5408\uff1a\n\n*   `-O1`\uff08\u5fc5\u9700\uff0c\u6216\u66f4\u9ad8\u7ea7\u522b\uff0c\u4ee5\u83b7\u5f97\u5408\u7406\u6027\u80fd\uff09\n*   `-g`\uff08\u5728\u6240\u751f\u6210\u7684\u8b66\u544a\u6d88\u606f\u4e2d\u663e\u793a\u6e90\u6587\u4ef6\u540d\u4e0e\u884c\u53f7\uff09\n\nUBSan \u7684\u8fd0\u884c\u65f6\u884c\u4e3a\u53ef\u4ee5\u901a\u8fc7\n```plaintext\nUBSAN_OPTIONS\n```\n\u73af\u5883\u53d8\u91cf\u8c03\u6574\u3002\u82e5\u8bbe\u4e3a\n```plaintext\nUBSAN_OPTIONS=help=1\n```\n\uff0c\u63d2\u6869\u7a0b\u5e8f\u542f\u52a8\u65f6\u4f1a\u663e\u793a\u53ef\u7528\u9009\u9879\u3002\n\n\u4e0e\u5176\u4ed6 Sanitizer \u4e0d\u540c\uff0cUBSan \u9644\u5e26\u4e00\u4e2a\u53ef\u542f\u7528\u6700\u5c0f\u8fd0\u884c\u65f6\u7684\u9009\u9879\uff0c\u5b83\u4e0d\u4f1a\u66b4\u9732\u989d\u5916\u7684\u653b\u51fb\u9762\uff0c\u56e0\u6b64\u53ef\u4ee5\u5728\u751f\u4ea7\u73af\u5883\u4e2d\u542f\u7528\u3002\u5728 Clang \u4e2d\u53ef\u7528\n```plaintext\n-fsanitize-minimal-runtime\n```\n\u6807\u5fd7\u3001\u5728 GCC \u4e2d\u53ef\u7528\n```plaintext\n-fsanitize-trap=undefined\n```\n\u6807\u5fd7\u6765\u542f\u7528\u5b83\u3002\n\n* * *\n\n## \u628a\u8c03\u8bd5\u4fe1\u606f\u4fdd\u5b58\u5728\u5355\u72ec\u7684\u6587\u4ef6\u4e2d\n\n\u5e94\u7528\u7a0b\u5e8f\u7684\u8c03\u8bd5\u4fe1\u606f\u53ef\u4ee5\u653e\u5728\u4e0e\u53ef\u6267\u884c\u6587\u4ef6\u5206\u79bb\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u4e2d\u3002\u8fd9\u6837\u5c31\u80fd\u5728\u53d1\u5e03\u53ef\u6267\u884c\u6587\u4ef6\u65f6\u53bb\u6389\u8c03\u8bd5\u4fe1\u606f\uff0c\u540c\u65f6\u5728\u8bca\u65ad\u53d1\u5e03\u7248\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u7684\u95ee\u9898\u65f6\uff0c\u8c03\u8bd5\u5668\u4ecd\u53ef\u4ece\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u83b7\u53d6\u8c03\u8bd5\u4fe1\u606f\u3002GNU \u8c03\u8bd5\u5668\uff08GDB\uff09\u4e0e LLVM \u8c03\u8bd5\u5668\uff08LLDB\uff09\u90fd\u652f\u6301\u4e3a\u5df2\u5265\u79bb\u7684\u4e8c\u8fdb\u5236\u4ece\u5355\u72ec\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u52a0\u8f7d\u8c03\u8bd5\u4fe1\u606f\u3002\n\n\u5f00\u53d1\u8005\u53ef\u80fd\u5e0c\u671b\u628a\u8c03\u8bd5\u4fe1\u606f\u4e0e\u53ef\u6267\u884c\u6587\u4ef6\u5206\u79bb\uff0c\u539f\u56e0\u6709\u51e0\u70b9\uff1a\n\n*   \u8c03\u8bd5\u4fe1\u606f\u53ef\u80fd\u975e\u5e38\u5927\u2014\u2014\u67d0\u4e9b\u60c5\u51b5\u4e0b\u751a\u81f3\u6bd4\u53ef\u6267\u884c\u4ee3\u7801\u672c\u8eab\u8fd8\u5927\uff01\u82e5\u5206\u79bb\u51fa\u6765\uff0c\u5c31\u53ef\u4ee5\u5728\u4e0d\u9700\u8981\u5b83\u4eec\u7684\u5730\u65b9\u7701\u7565\u3002\u6b63\u56e0\u5982\u6b64\uff0c\u5927\u591a\u6570 Linux \u53d1\u884c\u7248\u628a\u5e94\u7528\u8f6f\u4ef6\u5305\u7684\u8c03\u8bd5\u4fe1\u606f\u653e\u5728\u5355\u72ec\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u4e2d\u5206\u53d1\u3002\n*   \u82e5\u5e94\u7528\u7a0b\u5e8f\u6e90\u7801\u4e0d\u53ef\u5f97\uff0c\u5b83\u53ef\u907f\u514d\u65e0\u610f\u4e2d\u6cc4\u9732\u67d0\u4e9b\u654f\u611f\u7684\u5e94\u7528\u7a0b\u5e8f\u5b9e\u73b0\u7ec6\u8282\u3002\u7b26\u53f7\u4fe1\u606f\u7684\u53ef\u7528\u6027\u4f1a\u4f7f\u5f97\u5bf9\u53ef\u6267\u884c\u6587\u4ef6\u7684\u4e8c\u8fdb\u5236\u5206\u6790\u4e0e\u9006\u5411\u5de5\u7a0b\u66f4\u5bb9\u6613\u3002\u4e0d\u8fc7\u53cd\u7f16\u8bd1\u5668\u4e4b\u7c7b\u7684\u5de5\u5177\u5728\u6ca1\u6709\u8c03\u8bd5\u4fe1\u606f\u65f6\u4e5f\u80fd\u5de5\u4f5c\uff0c\u56e0\u6b64\u7cfb\u7edf\u7684\u5b89\u5168\u6027**\u4e0d\u80fd**\u4f9d\u8d56\u7701\u7565\u8fd9\u7c7b\u4fe1\u606f\u3002\n\n\u4e0b\u9762\u8fd9\u7ec4\u547d\u4ee4\u751f\u6210\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u3001\u4ece\u4e3b\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u5265\u79bb\u8c03\u8bd5\u4fe1\u606f\uff0c\u5e76\u6dfb\u52a0\u8c03\u8bd5\u94fe\u63a5\u6bb5\u3002\n\n```\nobjcopy --only-keep-debug executable_file executable_file.debug\nobjcopy --strip-unneeded executable_file\nobjcopy --add-gnu-debuglink=executable_file.debug executable_file\n```\n\n### ELF \u4e8c\u8fdb\u5236\u683c\u5f0f\u4e2d\u7684\u8c03\u8bd5\u4fe1\u606f\n\n\u5728 ELF \u4e8c\u8fdb\u5236\u4e2d\uff0c\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\u5b58\u653e\u5728\u5404\u81ea\u7684 ELF \u6bb5\uff08section\uff09\u4e2d\uff0c\u9664\u975e\u521b\u5efa\u4e86\u5355\u72ec\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u3002\u8868 5 \u5217\u51fa\u4e86\u901a\u5e38\u5305\u542b\u8c03\u8bd5\u3001\u7b26\u53f7\u6216\u5176\u4ed6\u8f85\u52a9\u4fe1\u606f\u7684 ELF \u6bb5\u3002\n\n\u8868 5\uff1aELF \u6bb5\u3002\n\n- **`.debug`**\uff1a\u4f9b\u8c03\u8bd5\u5668\u4f7f\u7528\u7684\u7b26\u53f7\u8c03\u8bd5\u4fe1\u606f\uff08\u901a\u5e38\u4e3a DWARF \u683c\u5f0f [131]\uff09\u3002\n- **`.comment`**\uff1aGCC \u7248\u672c\u4fe1\u606f\u3002\n- **`.dynstr`**\uff1a\u901a\u8fc7 `.dynsym` \u8fdb\u884c\u52a8\u6001\u7b26\u53f7\u540d\u67e5\u627e\u6240\u9700\u7684\u5b57\u7b26\u4e32\u3002\n- **`.dynsym`**\uff1a\u7528\u4e8e\u8fd0\u884c\u65f6\u91cd\u5b9a\u4f4d\u7684\u52a8\u6001\u7b26\u53f7\u67e5\u627e\u8868\u3002\n- **`.note`**\uff1a\u8f85\u52a9\u5143\u6570\u636e\uff0c\u4f8b\u5982 ABI \u6807\u7b7e [132] \u4e0e Build ID [133]\u3002\n- **`.strtab`**\uff1a\u8868\u793a `.symtab` \u4e2d\u540d\u5b57\u7684\u5b57\u7b26\u4e32\u3002\n- **`.symtab`**\uff1a\u4f9b\u8c03\u8bd5\u5668\u8fdb\u884c\u7b26\u53f7\u540d\u67e5\u627e\u7684\u5168\u5c40\u7b26\u53f7\u8868\u3002\n\nELF \u4e8c\u8fdb\u5236\u4e2d\u67d0\u4e2a\u7279\u5b9a\u6bb5\u5b58\u5728\u4e0e\u5426\uff0c\u8868\u660e\u4e86\u54ea\u4e9b\u7c7b\u578b\u7684\u4fe1\u606f\u53ef\u7528\u3002\u7b26\u53f7\u4fe1\u606f\u7684\u53ef\u7528\u6027\u4f1a\u4f7f\u4e8c\u8fdb\u5236\u5206\u6790\u66f4\u5bb9\u6613\uff0c\u56e0\u4e3a\u8c03\u8bd5\u5668\u3001\u53cd\u6c47\u7f16\u5668\u4ee5\u53ca Ghidra [134]\u3001IDA Pro [135] \u7b49\u4e8c\u8fdb\u5236\u4ee3\u7801\u5206\u6790\u5de5\u5177\uff0c\u53ef\u4ee5\u5229\u7528\u53ef\u7528\u7684\u7b26\u53f7\u4fe1\u606f\u4e3a\u53cd\u7f16\u8bd1\u540e\u7684\u673a\u5668\u7801\u81ea\u52a8\u52a0\u6ce8\u3002\u540c\u7406\uff0c\u8c03\u8bd5\u4fe1\u606f\u7684\u53ef\u7528\u6027\u4f1a\u4f7f\u5728\u8c03\u8bd5\u5668\u4e2d\u5bf9\u8be5\u5e94\u7528\u505a\u52a8\u6001\u5206\u6790\u66f4\u5bb9\u6613\u3002\u4ece\u4e8c\u8fdb\u5236\u4e2d\u5265\u79bb\u4e0d\u5fc5\u8981\u7684\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\uff0c\u5e76\u4e0d\u80fd\u8ba9\u5b83\u514d\u4e8e\u9006\u5411\u5de5\u7a0b\uff0c\u4f46\u4f1a\u663e\u8457\u63d0\u9ad8\u6210\u529f\u5229\u7528\u6240\u9700\u7684\u6210\u672c\u4e0e\u4eba\u5de5\u6295\u5165\u3002\n\n### \u521b\u5efa\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\n\n\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u662f\u666e\u901a\u7684\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u5176\u6bb5\u5e03\u5c40\u4e0e\u5e94\u7528\u7a0b\u5e8f\u539f\u59cb\u53ef\u6267\u884c\u6587\u4ef6\u5b8c\u5168\u76f8\u540c\uff0c\u4f46\u4e0d\u542b\u53ef\u6267\u884c\u6570\u636e\u3002\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u521b\u5efa\u65b9\u6cd5\u662f\uff1a\u5e26\u6240\u9700\u8c03\u8bd5\u4fe1\u606f\u7f16\u8bd1\u51fa\u5e94\u7528\u7a0b\u5e8f\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u7136\u540e\u7528\n```plaintext\nobjcopy\n```\n\u5de5\u5177\u5904\u7406\u8be5\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u4ea7\u51fa\u5df2\u5265\u79bb\u7684\u53ef\u6267\u884c\u6587\u4ef6\uff08\u65e0\u8c03\u8bd5\u4fe1\u606f\uff09\u4e0e\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\uff08\u65e0\u53ef\u6267\u884c\u6570\u636e\uff09\u3002GNU binutils \u7684\n```plaintext\nobjcopy\n```\n[136] \u4e0e LLVM \u7684\n```plaintext\nllvm-objcopy\n```\n[137] \u90fd\u652f\u6301\u76f8\u540c\u7684\u9009\u9879\u6765\u5265\u79bb\u8c03\u8bd5\u4fe1\u606f\u5e76\u521b\u5efa\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u3002\u4e0b\u9762\u7684 shell \u7247\u6bb5\u5c55\u793a\u4e86\u4ece\u5e26\u8c03\u8bd5\u4fe1\u606f\u7684\u53ef\u6267\u884c\u6587\u4ef6\u521b\u5efa\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\n```plaintext\nobjcopy\n```\n\u8c03\u7528\u3002\n\n```\nobjcopy --only-keep-debug executable_file executable_file.debug\n```\n\n\u8c03\u8bd5\u94fe\u63a5\u6587\u4ef6\u540d\u6ca1\u6709\u7279\u6b8a\u8981\u6c42\uff0c\u4e0d\u8fc7\u5e38\u89c1\u7ea6\u5b9a\u662f\u628a\u53ef\u6267\u884c\u6587\u4ef6\u7684\u8c03\u8bd5\u4fe1\u606f\u547d\u540d\u4e3a \u201cexecutable.debug\u201d \u4e4b\u7c7b\u3002\u867d\u7136\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u53ef\u4ee5\u4e0e\u53ef\u6267\u884c\u6587\u4ef6\u540c\u540d\uff0c\u4f46\u66f4\u63a8\u8350\u4f7f\u7528 \u201c.debug\u201d \u8fd9\u6837\u7684\u6269\u5c55\u540d\uff0c\u56e0\u4e3a\u8fd9\u610f\u5473\u7740\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u53ef\u4ee5\u653e\u5728\u4e0e\u53ef\u6267\u884c\u6587\u4ef6\u76f8\u540c\u7684\u76ee\u5f55\u4e2d\u3002\n\n\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u4f7f\u5f97\u53ef\u4ee5\u50cf\u5206\u6790\u4fdd\u7559\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\u7684\u539f\u59cb\u4e8c\u8fdb\u5236\u90a3\u6837\u5206\u6790\u8be5\u4e8c\u8fdb\u5236\u3002\u5e94\u5f53\u5c0f\u5fc3\u5904\u7406\u5b83\u4eec\uff0c\u4e0d\u8981\u628a\u5b83\u4eec\u66b4\u9732\u5728\u53ef\u80fd\u88ab\u653b\u51fb\u8005\u83b7\u53d6\u7684\u8ba1\u7b97\u73af\u5883\u4e2d\u3002\n\n### \u5265\u79bb\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\n\n\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u521b\u5efa\u5b8c\u6210\u540e\uff0c\u5373\u53ef\u7528 Binutils \u63d0\u4f9b\u7684\n```plaintext\nobjcopy\n```\n\u6216\n```plaintext\nstrip\n```\n[138] \u5de5\u5177\uff0c\u6216 LLVM \u63d0\u4f9b\u7684\n```plaintext\nllvm-objcopy\n```\n\u6216\n```plaintext\nllvm-strip\n```\n[139] \u7b49\u4ef7\u5de5\u5177\uff0c\u4ece\u539f\u59cb\u4e8c\u8fdb\u5236\u4e2d\u5265\u79bb\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\u3002\u4e0b\u9762\u7684 shell \u7247\u6bb5\u5c55\u793a\u4e86\u5206\u522b\u7528\n```plaintext\nobjcopy\n```\n\u4e0e\n```plaintext\nstrip\n```\n\u4ece\u53ef\u6267\u884c\u6587\u4ef6\u79fb\u9664\u8c03\u8bd5\u4e0e\u4e0d\u9700\u8981\u7684\u7b26\u53f7\u4fe1\u606f\u3002\u82e5\u5bf9\u5e94\u7528\u7a0b\u5e8f\u4e8c\u8fdb\u5236\u5f3a\u5236\u5b9e\u65bd\u4ee3\u7801\u7b7e\u540d\uff0c\u5219\u5fc5\u987b\u5728\u7b7e\u540d\u4e4b\u524d\u5265\u79bb\u8c03\u8bd5\u4e0e\u7b26\u53f7\u4fe1\u606f\u3002\n\n```\nstrip --strip-unneeded executable_file\n\nobjcopy --strip-unneeded executable_file\n```\n\n```plaintext\nobjcopy\n```\n\u4e2d\u7684\n```plaintext\n--strip-unneeded\n```\n\u9009\u9879\u4f1a\u4ece\u4e8c\u8fdb\u5236\u4e2d\u79fb\u9664\u6240\u6709\u5904\u7406\u91cd\u5b9a\u4f4d\u65f6\u4e0d\u9700\u8981\u7684\u7b26\u53f7\u4fe1\u606f\uff08ELF \u7684\n```plaintext\n.symtab\n```\n\u4e0e\n```plaintext\n.strtab\n```\n\u6bb5\uff09\u3002\u6b64\u5916\uff0c\u5b83\u8fd8\u4f1a\u89e6\u53d1\u79fb\u9664\u4e8c\u8fdb\u5236\u4e2d\u7684\u4efb\u4f55\u7b26\u53f7\u8c03\u8bd5\u4fe1\u606f\uff08ELF \u7684\n```plaintext\n.debug\n```\n\u6bb5\u4ee5\u53ca\u6240\u6709\u4ee5\n```plaintext\n.debug\n```\n\u4e3a\u524d\u7f00\u7684\u6bb5\uff09\u3002\n\n\u4e0d\u5efa\u8bae\u79fb\u9664\u7528\u4e8e\u91cd\u5b9a\u4f4d\u7684\u7b26\u53f7\u4fe1\u606f\uff0c\u56e0\u4e3a\u5b83\u53ef\u80fd\u5e72\u6270\u52a8\u6001\u94fe\u63a5\u7b26\u53f7\uff08ELF \u7684\n```plaintext\n.dynsym\n```\n\u4e0e\n```plaintext\n.dynstr\n```\n\u6bb5\uff09\u7684\u89e3\u6790\u4ee5\u53ca\u8fd0\u884c\u65f6\u7684\u5730\u5740\u7a7a\u95f4\u5e03\u5c40\u968f\u673a\u5316\uff08ASLR\uff09\u3002\u56e0\u6b64\u5e94\u5f53\u9884\u671f\uff1a\u8c03\u8bd5\u5668\u4e0e\u4e8c\u8fdb\u5236\u5206\u6790\u4ecd\u80fd\u5c06\u5bf9\u52a8\u6001\u94fe\u63a5\u51fd\u6570\u7684\u8c03\u7528\u89e3\u6790\u5230\u6b63\u786e\u7684\u7b26\u53f7\u4fe1\u606f\u3002\u5728\u9002\u7528\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u4ee5\u8003\u8651\u6539\u7528\u9759\u6001\u94fe\u63a5\uff0c\u4ee5\u907f\u514d\u52a8\u6001\u94fe\u63a5\u7b26\u53f7\u5728\u6700\u7ec8\u4e8c\u8fdb\u5236\u4e2d\u4ecd\u7136\u53ef\u89c1\u3002\n\n**\u5265\u79bb\u989d\u5916\u6bb5**\n\n\u6ce8\u610f\n```plaintext\n--strip-unneeded\n```\n\u53ea\u628a\u6807\u51c6 ELF \u6bb5\u89c6\u4e3a\u53ef\u4e22\u5f03\u3002\u7531\u4e8e ELF \u4e8c\u8fdb\u5236\u53ef\u4ee5\u6709\u4efb\u610f\u591a\u4e2a\n```plaintext\nobjcopy\n```\n\u4e0e\n```plaintext\nstrip\n```\n\u4e0d\u8ba4\u8bc6\u7684\u989d\u5916\u6bb5\uff0c\u5b83\u4eec\u65e0\u6cd5\u5224\u65ad\u8fd9\u7c7b\u65e0\u6cd5\u8bc6\u522b\u7684\u6bb5\u662f\u5426\u53ef\u4ee5\u5b89\u5168\u79fb\u9664\u3002\u4f8b\u5982\u8fd9\u5305\u62ec GCC \u6dfb\u52a0\u7684\n```plaintext\n.comment\n```\n\u6bb5\u3002\u4e0b\u9762\u7684 shell \u7247\u6bb5\u5c55\u793a\u4e86\u9664\u4e86\n```plaintext\n--strip-unneeded\n```\n\u8bc6\u522b\u51fa\u7684\u4e0d\u5fc5\u8981\u6bb5\u4e4b\u5916\uff0c\u5982\u4f55\u989d\u5916\u79fb\u9664\u975e\u6807\u51c6\u6bb5\uff08\u5982\n```plaintext\n.comment\n```\n\uff09\u3002\u82e5\u5e94\u7528\u7a0b\u5e8f\u5305\u542b\u81ea\u5b9a\u4e49\u7684\u3001\u5e94\u7528\u7279\u6709\u7684 ELF \u6bb5\uff0c\u5176\u4e2d\u5e26\u6709\u53ef\u80fd\u7684\u654f\u611f\u8bca\u65ad\u4fe1\u606f\u6216\u6b63\u5e38\u8fd0\u884c\u65f6\u4e0d\u9700\u8981\u7684\u5143\u6570\u636e\uff0c\u5f00\u53d1\u8005\u53ef\u80fd\u5e0c\u671b\u4ece\u53d1\u5e03\u4e8c\u8fdb\u5236\u4e2d\u5265\u79bb\u6b64\u7c7b\u989d\u5916\u6bb5\u3002\n\n```\nobjcopy --strip-unneeded --remove-section=.comment executable_file\n\nstrip --strip-unneeded --remove-section=.comment executable_file\n```\n\n### \u4e3a\u4e8c\u8fdb\u5236\u6dfb\u52a0\u8c03\u8bd5\u94fe\u63a5\n\n\u4e3a\u4e86\u8ba9\u8c03\u8bd5\u5668\u8bc6\u522b\u6b63\u786e\u7684\u8c03\u8bd5\u4fe1\u606f\uff0c\u53ef\u6267\u884c\u6587\u4ef6\u5fc5\u987b\u4e0e\u5176\u5bf9\u5e94\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u76f8\u5173\u8054\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7\u4e24\u79cd\u65b9\u5f0f\u5b8c\u6210\uff1a\n\n*   \u5728\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u5305\u542b\u4e00\u4e2a\u201c\u8c03\u8bd5\u94fe\u63a5\u201d\uff0c\u6307\u660e\u5bf9\u5e94\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u540d\u79f0\u3002\n*   \u5728\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u5305\u542b\u4e00\u4e2a\u201c\u6784\u5efa ID\u201d\uff08build ID\uff09\uff0c\u5373\u4e00\u4e2a\u552f\u4e00\u7684\u4f4d\u4e32\uff0c\u53ef\u636e\u5176\u63a8\u5bfc\u51fa\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u540d\u79f0\u3002\n\n\u5927\u591a\u6570\u60c5\u51b5\u4e0b\u8c03\u8bd5\u94fe\u63a5\u66f4\u53ef\u53d6\uff0c\u56e0\u4e3a\u5b83\u5141\u8bb8\u5f00\u53d1\u8005\u81ea\u884c\u547d\u540d\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\uff0c\u5e76\u5728\u8c03\u8bd5\u671f\u95f4\u4ece\u8be5\u6587\u4ef6\u53d6\u7528\u7b26\u53f7\u4fe1\u606f\u4e4b\u524d\uff0c\u6821\u9a8c\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u5185\u5bb9\u7684\u6821\u9a8c\u548c\u3002\n\n**\u8c03\u8bd5\u94fe\u63a5**\n\n\u8c03\u8bd5\u94fe\u63a5\u662f\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u7684\u4e00\u4e2a\u7279\u6b8a\u6bb5\uff08\n```plaintext\n.gnu_debuglink\n```\n\uff09\uff0c\u5176\u4e2d\u5305\u542b\u5bf9\u5e94\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u540d\u79f0\uff0c\u4ee5\u53ca\u5bf9\u8be5\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u5168\u90e8\u5185\u5bb9\u8ba1\u7b97\u7684 32 \u4f4d\u5faa\u73af\u5197\u4f59\u6821\u9a8c\uff08CRC\uff09\u3002\u4efb\u4f55\u53ef\u6267\u884c\u6587\u4ef6\u683c\u5f0f\u53ea\u8981\u80fd\u591f\u5305\u542b\u540d\u4e3a\n```plaintext\n.gnu_debuglink\n```\n\u7684\u6bb5\uff0c\u5c31\u80fd\u643a\u5e26\u8c03\u8bd5\u94fe\u63a5\u4fe1\u606f\u3002\u4e0b\u9762\u7684 shell \u7247\u6bb5\u5c55\u793a\u4e86\u5982\u4f55\u7528\n```plaintext\nobjcopy\n```\n\uff08\u6216\n```plaintext\nllvm-objcopy\n```\n\uff09\u4e3a\u53ef\u6267\u884c\u6587\u4ef6\u6dfb\u52a0\u8c03\u8bd5\u94fe\u63a5\u3002\n\n```\nobjcopy --add-gnu-debuglink=executable_file.debug executable_file\n```\n\n\u82e5\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u5728\u4e00\u4e2a\u4f4d\u7f6e\u6784\u5efa\u3001\u4e4b\u540e\u8981\u5b89\u88c5\u5230\u53e6\u4e00\u4e2a\u4f4d\u7f6e\uff0c\u4f7f\u7528\n```plaintext\n--add-gnu-debuglink\n```\n\u9009\u9879\u65f6\u5e94\u7ed9\u51fa\u6240\u6784\u5efa\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u8def\u5f84\u3002\u8be5\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u5fc5\u987b\u5b58\u5728\u4e8e\u6307\u5b9a\u8def\u5f84\uff0c\u56e0\u4e3a CRC \u8ba1\u7b97\u9700\u8981\u5b83\uff0c\u4ee5\u4fbf\u8c03\u8bd5\u5668\u9a8c\u8bc1\u5176\u52a0\u8f7d\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u4e0e\u53ef\u6267\u884c\u6587\u4ef6\u76f8\u5339\u914d\u3002\n\n\u6ce8\u610f\n```plaintext\n.gnu_debuglink\n```\n\u5e76\u4e0d\u5305\u542b\u8c03\u8bd5\u4fe1\u606f\u7684\u5b8c\u6574\u8def\u5f84\u540d\uff0c\u53ea\u5305\u542b\u53bb\u6389\u524d\u5bfc\u76ee\u5f55\u6210\u5206\u7684\u6587\u4ef6\u540d\u3002GDB \u4f1a\u4ece\u53ef\u6267\u884c\u6587\u4ef6\u6240\u5728\u76ee\u5f55\u5f00\u59cb\uff0c\u5728\u4e00\u7cfb\u5217\u641c\u7d22\u76ee\u5f55\u4e2d\u67e5\u627e\u5177\u6709\u6307\u5b9a\u6587\u4ef6\u540d\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u3002\u5b8c\u6574\u7684\u641c\u7d22\u8def\u5f84\u5217\u8868\u8bf7\u53c2\u9605 GDB \u6587\u6863 [140]\u3002\n\n**\u6784\u5efa ID**\n\n\u6784\u5efa ID \u662f\u5b58\u653e\u5728 ELF\n```plaintext\n.note\n```\n\u6bb5\u7684\n```plaintext\n.note.gnu.build-id\n```\n\u4e2d\u7684\u552f\u4e00\u4f4d\u4e32\uff0c\u5b83\uff08\u5728\u7edf\u8ba1\u610f\u4e49\u4e0a\uff09\u5bf9\u4e8c\u8fdb\u5236\u6587\u4ef6\u552f\u4e00\u3002\u82e5\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u4e2d\u4e5f\u5b58\u5728\u76f8\u540c\u7684\u6784\u5efa ID\uff0c\u8c03\u8bd5\u5668\u5373\u53ef\u7528\u5b83\u8bc6\u522b\u5bf9\u5e94\u7684\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u3002\n\n\u82e5\u91c7\u7528\u6784\u5efa ID \u65b9\u5f0f\uff0c\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u540d\u79f0\u7531\u6784\u5efa ID \u8ba1\u7b97\u5f97\u51fa\u3002GDB \u4f1a\u5230\u5168\u5c40\u8c03\u8bd5\u76ee\u5f55\uff08\u901a\u5e38\u4e3a\n```plaintext\n/usr/lib/debug\n```\n\uff09\u4e2d\u67e5\u627e\n```plaintext\n.build-id/xx/yyyy.debug\n```\n\u6587\u4ef6\uff0c\u5176\u4e2d\n```plaintext\nxx\n```\n\u662f\u6784\u5efa ID \u7684\u524d\u4e24\u4e2a\u5341\u516d\u8fdb\u5236\u5b57\u7b26\uff0c\n```plaintext\nyyyy\n```\n\u662f\u6784\u5efa ID \u4f4d\u4e32\u5176\u4f59\u90e8\u5206\u7684\u5341\u516d\u8fdb\u5236\u8868\u793a\uff08\u5b9e\u9645\u6784\u5efa ID \u5b57\u7b26\u4e32\u4e3a 32 \u4e2a\u6216\u66f4\u591a\u5341\u516d\u8fdb\u5236\u5b57\u7b26\uff09\u3002\n\n\u6ce8\u610f\u6784\u5efa ID \u5e76\u4e0d\u5145\u5f53\u53ef\u6267\u884c\u6587\u4ef6\u6216\u8c03\u8bd5\u4fe1\u606f\u6587\u4ef6\u7684\u6821\u9a8c\u548c\u3002\u6709\u5173\u6784\u5efa ID \u7279\u6027\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605 GDB [136] \u4e0e GNU \u94fe\u63a5\u5668 [133] \u6587\u6863\u3002\n\n## \u7f16\u8bd1\u7f16\u8bd1\u5668\u65f6\u8be5\u600e\u4e48\u505a\uff1f\n\n\u5982\u679c\u4f60\u5728\u7f16\u8bd1 C/C++ \u7f16\u8bd1\u5668\uff0c\u5728\u53ef\u884c\u7684\u60c5\u51b5\u4e0b\u5e94\u8ba9\u6240\u751f\u6210\u7f16\u8bd1\u5668\u7684\u9ed8\u8ba4\u9009\u9879\u6210\u4e3a**\u5b89\u5168**\u9009\u9879\u3002\u4e0b\u8868\u6c47\u603b\u4e86\u5728\u6784\u5efa GCC \u6216 Clang \u65f6\u53ef\u4ee5\u6307\u5b9a\u3001\u7528\u4e8e\u5f71\u54cd\u7f16\u8bd1\u5668\u9ed8\u8ba4\u884c\u4e3a\u7684\u76f8\u5173\u9009\u9879\uff1a\n\n- **`--enable-default-pie`**\uff08GCC 6.1.0\uff09\uff1a\u5bf9\u7f16\u8bd1\u5668\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u9ed8\u8ba4\u5f00\u542f `-fPIE` \u4e0e `-pie`\u3002\n- **`--enable-default-ssp`**\uff08GCC 6.1.0\uff09\uff1a\u5bf9\u7f16\u8bd1\u5668\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u9ed8\u8ba4\u5f00\u542f `-fstack-protector-strong`\u3002\n- **`--enable-host-pie`**\uff08GCC 14.0.0\uff09\uff1a\u7528 `-fPIE` \u4e0e `-pie` \u6784\u5efa\u7f16\u8bd1\u5668\u53ef\u6267\u884c\u6587\u4ef6\u3002\n- **`--enable-host-bind-now`**\uff08GCC 14.0.0\uff09\uff1a\u7528 `-Wl,-z,now` \u6784\u5efa\u7f16\u8bd1\u5668\u53ef\u6267\u884c\u6587\u4ef6\u3002\n\n\u6ce8\u610f LLVM \u5efa\u8bae\u4f7f\u7528 Clang \u914d\u7f6e\u6587\u4ef6 [141] \u5411\u7f16\u8bd1\u5668\u4f20\u9012\u76f8\u5173\u9ed8\u8ba4\u503c\u3002\u914d\u7f6e\u6587\u4ef6\u4e2d\u63d0\u4f9b\u7684\u547d\u4ee4\u884c\u9009\u9879\u4f1a\u88ab\u524d\u7f6e\u5230\u547d\u4ee4\u884c\u5176\u4f59\u9009\u9879\u4e4b\u524d\u3002\n\n## \u7f16\u8bd1\u94fe\u63a5\u5668\u65f6\u8be5\u600e\u4e48\u505a\uff1f\n\n\u5982\u679c\u4f60\u5728\u7f16\u8bd1\u94fe\u63a5\u5668\uff0c\u5728\u53ef\u884c\u7684\u60c5\u51b5\u4e0b\u5e94\u8ba9\u6240\u751f\u6210\u94fe\u63a5\u5668\u7684\u9ed8\u8ba4\u9009\u9879\u6210\u4e3a**\u5b89\u5168**\u9009\u9879\u3002\u4e0b\u8868\u6c47\u603b\u4e86\u5728\u6784\u5efa GNU Binutils \u65f6\u53ef\u4ee5\u6307\u5b9a\u3001\u7528\u4e8e\u5f71\u54cd\u94fe\u63a5\u5668\u9ed8\u8ba4\u884c\u4e3a\u7684\u76f8\u5173\u9009\u9879\uff1a\n\n- **`--disable-default-execstack`**\uff08Binutils 2.39\uff09\uff1a\u8981\u6c42\u53ef\u6267\u884c\u6808\u5fc5\u987b\u5e26\u6709 `GNU_STACK` ELF \u6ce8\u8bb0\uff0c\u800c\u4e0d\u662f\u9ed8\u8ba4\u542f\u7528\u53ef\u6267\u884c\u6808\u3002\n- **`--enable-warn-execstack`**\uff08Binutils 2.39\uff09\uff1a\u5f53\u901a\u8fc7 `GNU_STACK` \u8bf7\u6c42\u53ef\u6267\u884c\u6808\u65f6\u53d1\u51fa\u8b66\u544a\u3002\n- **`--enable-error-execstack`**\uff08Binutils 2.42\uff09\uff1a\u5f53\u8bf7\u6c42\u53ef\u6267\u884c\u6808\u65f6\u62a5\u9519\uff0c\u5373\u4fbf\u5e26\u6709 `GNU_STACK` \u4e5f\u662f\u5982\u6b64\u3002\n- **`--enable-warn-rwx-segments`**\uff08Binutils 2.39\uff09\uff1a\u5f53\u67d0\u4e2a\u6bb5\u5177\u6709\u4e0d\u5b89\u5168\u6743\u9650\u65f6\u53d1\u51fa\u8b66\u544a\u3002\n- **`--enable-error-rwx-segments`**\uff08Binutils 2.42\uff09\uff1a\u5f53\u67d0\u4e2a\u6bb5\u5177\u6709\u4e0d\u5b89\u5168\u6743\u9650\u65f6\u62a5\u9519\u3002\n- **`--enable-relro`**\uff08Binutils 2.27\uff09\uff1a\u9ed8\u8ba4\u4f20\u5165 `-Wl,-z,relro`\u3002\n- **`--enable-textrel-check=`**\uff08Binutils 2.35\uff09\uff1a\u63a7\u5236 TEXTREL \u662f\u81f4\u547d\u9519\u8bef\uff08`=error`\uff09\u3001\u8b66\u544a\uff08`=warn`\uff09\u8fd8\u662f\u88ab\u5ffd\u7565\uff08`=no`\uff09\u3002\n- **`--enable-secureplt`**\uff08Binutils 2.16\uff09\uff1a\u4f7f PLT \u53ea\u8bfb\u3002\u4ec5\u9002\u7528\u4e8e Alpha \u4e0e PowerPC \u67b6\u6784\u3002\n\n\u5173\u4e8e\u8fd9\u4e9b\u9009\u9879\u88ab\u5f15\u5165 GNU Binutils \u7684\u80cc\u666f\uff0c\u53ef\u53c2\u9605\u5176\u9996\u5e2d\u7ef4\u62a4\u8005 Nick Clifton \u7684\u6587\u7ae0 [142]\u3002\n\n\u6ce8\u610f LLVM \u5efa\u8bae\u4f7f\u7528 Clang \u914d\u7f6e\u6587\u4ef6\uff0c\u901a\u8fc7\u7f16\u8bd1\u5668\u9a71\u52a8\u7a0b\u5e8f\u5411\u94fe\u63a5\u5668\u4f20\u9012\u76f8\u5173\u9009\u9879\uff0c\u56e0\u6b64\u8fd9\u91cc\u4e0d\u5b58\u5728\u6b64\u7c7b\u9009\u9879\u3002\n\n## \u8d21\u732e\u8005\n\nOpenSSF \u5f00\u53d1\u8005\u6700\u4f73\u5b9e\u8df5\u5de5\u4f5c\u7ec4\u611f\u8c22 Ericsson \u6177\u6168\u5730\u521d\u6b65\u6350\u8d60\u5185\u5bb9\uff0c\u4ece\u800c\u542f\u52a8\u672c\u6307\u5357\u7684\u534f\u4f5c\u3002\n\n*   Thomas Nyman\uff0cEricsson\n*   Robert Byrne\uff0cEricsson\n*   Jussi Auvinen\uff0cEricsson\n*   Christopher \u201cCRob\u201d Robinson\uff0cIntel\n*   Daniel Stenberg\uff0cwolfSSL\n*   David A. Wheeler\uff0cLinux Foundation\n*   David Edelsohn\uff0cIBM\n*   Dominik Czarnota\uff0cTrail of Bits\n*   Florian Berbar\n*   Florian Weimer\uff0cRed Hat\n*   Gabriel Dos Reis\uff0cMicrosoft\n*   Georg Kunz\uff0cEricsson\n*   George Wilson\uff0cIBM\n*   Jack Kelly\uff0cControlPlane\n*   Jonathan Wakely\uff0cRed Hat\n*   Kees Cook\uff0cGoogle\n*   Mark Esler\uff0cCanonical\n*   Mayank Ramnani\uff0cNYU\n*   Merve G\u00fclmez\uff0cEricsson\n*   Randall T. Vasquez\uff0cLinux Foundation\n*   Robert C. Seacord\uff0cWoven by Toyota\n*   Sam James\uff0cGentoo\n*   Siddharth Sharma\uff0cRed Hat\n*   Siddhesh Poyarekar\uff0cRed Hat\n*   William Huhn\uff0cIntel\n\n## \u8bb8\u53ef\n\nCopyright 2024\uff0cOpenSSF \u8d21\u732e\u8005\uff0c\u4f9d\u636e [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) \u8bb8\u53ef\u3002\n\n## \u9644\u5f55\uff1a\u5df2\u8003\u8651\u8fc7\u7684\u7f16\u8bd1\u5668\u9009\u9879\u6e05\u5355\n\n\u4e0e\u672c\u6307\u5357\u63a8\u8350\u7684\u9009\u9879\u76f8\u6bd4\uff0c\u8fd8\u5b58\u5728\u66f4\u591a\u4e0e\u5b89\u5168\u76f8\u5173\u7684\u7f16\u8bd1\u5668\u9009\u9879\u3002\u5176\u4e2d\u4e00\u4e9b\u66fe\u88ab\u8003\u8651\u7eb3\u5165\uff0c\u4f46\u56e0\u5404\u79cd\u539f\u56e0\u6700\u7ec8\u672a\u88ab\u5217\u5165\u63a8\u8350\u9009\u9879\u96c6\u5408\u3002\u4e0b\u8868\u5217\u51fa\u7ecf\u8fc7\u8bc4\u5ba1\u7684\u9009\u9879\u53ca\u5176\u88ab\u6392\u9664\u7684\u7406\u7531\u3002\u867d\u7136\u5b83\u4eec\u4e0d\u5728\u63a8\u8350\u6e05\u5355\u4e2d\uff0c\u4f46\u4f60\u53ef\u80fd\u4f1a\u53d1\u73b0\u5b83\u4eec\u5bf9\u4f60\u6709\u7528\u3002\n\n- **`-Wl,-z,nodump`**\uff08Binutils 2.10.0\uff09\uff1a\u4e3a\u517c\u5bb9 Solaris \u800c\u8bbe\u7684\u5355\u4e00\u7528\u9014\u7279\u6027 [143]\u3002\n- **`-Wl,-z,noexecheap`**\uff08Binutils 2.15.0\uff0c\u4ec5 Hardened Gentoo / PaX\uff09\uff1aHardened Gentoo / PaX \u7279\u6709\u7684 Binutils \u6269\u5c55 [144]\uff0c\u4e0a\u6e38\u5de5\u5177\u94fe\u4e2d\u4e0d\u5b58\u5728\u3002\n- **`-D_LIBCPP_ASSERT`**\uff08libc++ 3.3.0\uff09\uff1a\u5df2\u5e9f\u5f03\uff0c\u6539\u7528 `_LIBCPP_ENABLE_HARDENED_MODE` [145]\u3002\n- **`-D_LIBCPP_ENABLE_ASSERTIONS`**\uff08libc++ 3.3.0\uff09\uff1a\u5df2\u5e9f\u5f03\uff0c\u6539\u7528 `_LIBCPP_ENABLE_HARDENED_MODE` [145]\u3002\n- **`-mshstk`**\uff08GCC 8.0.0\u3001Clang 6.0.0\uff09\uff1a\u542f\u7528\uff08\u4e0d\u63a8\u8350\u7684\uff09\u5f71\u5b50\u6808\u5185\u5efa\u51fd\u6570 [146]\uff0c\u8fd9\u4e9b\u51fd\u6570\u4ec5\u5bf9\u4ee5\u975e\u5e38\u89c4\u65b9\u5f0f\u7ba1\u7406\u7a0b\u5e8f\u6808\u7684\u7a0b\u5e8f\u624d\u9700\u8981\u3002CET \u63d2\u6869\u7531 `-fcf-protection` \u63a7\u5236\u3002\n- **`-fsanitize=safe-stack`**\uff08Clang 4.0.0\uff09\uff1a\u5728\u5783\u573e\u56de\u6536\u3001\u4fe1\u53f7\u5904\u7406\u4e0e\u5171\u4eab\u5e93\u65b9\u9762\u5b58\u5728\u5df2\u77e5\u517c\u5bb9\u6027\u9650\u5236 [147]\u3002\n- **`-fasynchronous-unwind-tables`**\uff08GCC 3.1.1\u3001Clang 7.0.0\uff09\uff1a\u4ee5 DWARF2 \u683c\u5f0f\u751f\u6210\u6808\u5c55\u5f00\u8868\uff0c\u53ef\u63d0\u9ad8\u5c55\u5f00\u4fe1\u606f\u7684\u7cbe\u5ea6 [148]\uff0c\u5e76\u80fd\u6539\u5584\u6027\u80fd\u5206\u6790\u5de5\u5177\u7684\u6027\u80fd\uff0c\u4ee3\u4ef7\u662f\u4e8c\u8fdb\u5236\u4f53\u79ef\u66f4\u5927 [149]\uff0c\u4f46\u5bf9\u5b89\u5168\u6027\u6ca1\u6709\u597d\u5904\u3002\n- **`-fvtable-verify`**\uff08GCC 4.9.4\uff09\uff1a\u542f\u7528\u5bf9 C++ \u865a\u51fd\u6570\u6307\u9488\u7834\u574f\u7684\u8fd0\u884c\u65f6\u68c0\u67e5\u3002\u6b64\u9009\u9879\u6709\u663e\u8457\u6027\u80fd\u5f00\u9500 [150]\uff0c\u4e14\u9664\u975e\u6574\u4e2a\u7528\u6237\u6001\u90fd\u4ee5 `-fvtable-verify` \u6784\u5efa\uff0c\u5426\u5219\u4f1a\u7834\u574f\u4e0e\u6240\u6709\u65e2\u6709\u7cfb\u7edf\u5e93\u7684 ABI [151]\u3002\u636e\u4fe1\u76ee\u524d\u5728 GCC \u4e2d\u5df2\u65e0\u4eba\u7ef4\u62a4\u3002\n- **`-mmitigate-rop`**\uff08GCC 6.1\uff09\uff1a\u907f\u514d\u67d0\u4e9b\u7279\u5b9a\u64cd\u4f5c\u7801\u7684\u7ec4\u5408\u88ab\u91cd\u65b0\u89e3\u91ca\u4e3a\u8fd4\u56de\u64cd\u4f5c\u7801\uff0c\u4ee5\u5c1d\u8bd5\u7f13\u89e3\u9762\u5411\u8fd4\u56de\u7f16\u7a0b\uff08ROP\uff09\u653b\u51fb [152]\u3002\u88ab\u8ba4\u4e3a\u65e0\u6548\u4e14\u5c5e\u4e8e\u201c\u5b89\u5168\u8868\u6f14\u201d\uff08security theatre\uff09\uff0c\u56e0\u6b64\u5728 GCC 9.1 \u4e2d\u88ab\u5e9f\u5f03 [153]\u3002\n- **`CLANG_DEFAULT_PIE_ON_LINUX`**\uff08Clang 14.0.0\uff09\uff1a\u5728\u7f16\u8bd1 Clang \u65f6\uff0c\u5bf9\u7f16\u8bd1\u5668\u751f\u6210\u7684\u4e8c\u8fdb\u5236\u9ed8\u8ba4\u5f00\u542f `-fPIE` \u4e0e `-pie`\u3002\u5df2\u88ab\u901a\u8fc7\u914d\u7f6e\u6587\u4ef6\u63d0\u4f9b\u7684\u9ed8\u8ba4\u503c\u53d6\u4ee3 [141]\u3002\n- **`-fsplit-stack`**\uff08GCC 4.6.0\uff09\uff1a\u751f\u6210\u5728\u6808\u6ea2\u51fa\u4e4b\u524d\u81ea\u52a8\u5207\u5206\u6808\u7684\u4ee3\u7801\uff0c\u4ee5\u652f\u6301\u5206\u6bb5\u6808 [154]\uff0c\u4f9b Boost Fibers \u4e4b\u7c7b\u6709\u6808\u534f\u7a0b\u4f7f\u7528\u3002\u5206\u6bb5\u6808\u4ee3\u7801\u4e0e\u975e\u5206\u6bb5\u6808\u4ee3\u7801\u4e4b\u95f4\u7684\u4e92\u64cd\u4f5c\u9700\u8981 gold \u94fe\u63a5\u5668\uff0c\u4ee5\u786e\u4fdd\u4e3a\u975e\u5206\u6bb5\u6808\u4ee3\u7801\u7684\u8c03\u7528\u5206\u914d\u66f4\u5927\u7684\u6808\u6bb5 [155]\u3002\u636e\u4fe1\u76ee\u524d\u5728 GCC \u4e2d\u5df2\u65e0\u4eba\u7ef4\u62a4\u3002\n\n## \u9644\u5f55\uff1a\u722c\u53d6\u811a\u672c\n\n[GitHub \u4ed3\u5e93](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Compiler-Hardening-Guides/)\u4e2d\u8fd8\u6709\u4e00\u4e2a Python \u811a\u672c\uff0c\u53ef\u4ee5\u4ece\u672c\u6307\u5357\u6700\u65b0\u7248\u672c\u6293\u53d6\u63a8\u8350\u9009\u9879\u8868\uff0c\u5e76\u8f6c\u6362\u4e3a\u673a\u5668\u53ef\u8bfb\u683c\u5f0f\uff08JSON\uff09\u4ee5\u4f9b\u5de5\u5177\u4f7f\u7528\u3002\n\n## \u53c2\u8003\u6587\u732e\n\n**1.** \u4f8b\u5982 Intel C/C++ \u7f16\u8bd1\u5668\u3001Arm Compiler for Embedded\u3001Xcode \u9644\u5e26\u7684 Apple Clang \u7f16\u8bd1\u5668\u3001IBM Open XL C/C++ \u7f16\u8bd1\u5668\u3001Red Hat Developer Toolset\u3001Siemens Sourcery \u5de5\u5177\u94fe\uff0c\u4ee5\u53ca AdaCore GNAT Pro Enterprise\u3002\n\n**2.** GNU libc\uff08glibc\uff09\u4e2d `-D_FORTIFY_SOURCE={1,2,3}` \u7684\u5b9e\u73b0\u5927\u91cf\u4f9d\u8d56 GCC \u7684\u5185\u90e8\u5b9e\u73b0\u7ec6\u8282\u3002Clang \u5b9e\u73b0\u4e86\u81ea\u5df1\u98ce\u683c\u7684\u52a0\u56fa\u51fd\u6570\u8c03\u7528\uff08\u6700\u521d\u4e3a Android \u7684 bionic libc \u5f15\u5165\uff09\uff0c\u4f46\u622a\u81f3 Clang / LLVM 14.0.6\uff0c\u5bf9\u67d0\u4e9b glibc \u51fd\u6570\u5728\u542f\u7528 `_FORTIFY_SOURCE` \u65f6\u4f1a\u9519\u8bef\u5730\u751f\u6210\u975e\u52a0\u56fa\u8c03\u7528\u3002\u7528 Clang \u8bbe\u5b9a\u4e3a\u52a0\u56fa\u7684\u4ee3\u7801\u4ecd\u53ef\u7f16\u8bd1\uff0c\u4f46\u672a\u5fc5\u603b\u80fd\u53d7\u76ca\u4e8e glibc \u4e2d\u7684\u52a0\u56fa\u51fd\u6570\u53d8\u4f53\u3002\u66f4\u591a\u4fe1\u606f\u89c1\uff1aGuelton, Serge, [Toward _FORTIFY_SOURCE parity between Clang and GCC. Red Hat Developer](https://developers.redhat.com/blog/2020/02/11/toward-_fortify_source-parity-between-clang-and-gcc), Red Hat Developer\uff0c2020-02-11\uff1b\u4ee5\u53ca Poyarekar, Siddhesh\uff0c[D91677 Avoid simplification of library functions when callee has an implementation](https://reviews.llvm.org/D91677), LLVM Phabricator, 2020-11-17.\n\n**3.** Cimpanu, Catalin, [Microsoft: 70 percent of all security bugs are memory safety issues](https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/), ZDNet, 2019-02-11\n\n**4.** Cimpanu, Catalin, [Chrome: 70% of all security bugs are memory safety issues](https://www.zdnet.com/article/chrome-70-of-all-security-bugs-are-memory-safety-issues/), ZDNet, 2020-05-22\n\n**5.** Internet Security Research Group, [Prossimo](https://www.memorysafety.org/), Prossimo project homepage. 2024-10-22.\n\n**6.** Wheeler, David A., [Improving Memory Safety without a Trillion Dollars](https://docs.google.com/presentation/d/1EDQL-6MUKrqbILBtYjpiF96uW5LXcnIuE-HxzyCIr68/edit), 2024.\n\n**7.** Volcovici, Valerie, [UN climate chief calls for $2.4 trillion in climate finance](https://www.reuters.com/sustainability/sustainable-finance-reporting/un-climate-chief-calls-24-trillion-climate-finance-2024-02-02/), Reuters, 2024-02-02.\n\n**8.** Claburn, Thomas, [Google\u2019s memory safety plan includes rehab for unsafe languages: Large C and C++ codebases will be around for the \u2018foreseeable future\u2019](https://www.theregister.com/2024/10/16/google_legacy_code/), The Register, 2024-10-16.\n\n**9.** Rebert, Alex; Carruth, Chandler; Engel, Jen, and Qin, Andy, [Safer with Google: Advancing Memory Safety](https://security.googleblog.com/2024/10/safer-with-google-advancing-memory.html), Google Security Blog, 2024-10-15.\n\n**10.** Carnegie Mellon University (CMU), [SEI CERT C Coding Standard Rules for Developing Safe, Reliable, and Secure Systems, 2016 edition](https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=454220), June 2016.\n\n**11.** Carnegie Mellon University (CMU), [SEI CERT C++ Coding Standard Rules for Developing Safe, Reliable, and Secure Systems, 2016 edition](https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=494932), March 2017.\n\n**12.** Esler, Mark, 2025-03-19, [Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening](https://www.chainguard.dev/unchained/mitigating-a-rsync-vulnerability-a-lesson-in-compiler-hardening), _Chainguard Unchained Security Blog_\n\n**13.** US NIST, [Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities](https://csrc.nist.gov/publications/detail/sp/800-218/final), NIST SP 800-218, February 2018.\n\n**14.** Carnegie Mellon University (CMU), [Top 10 Secure Coding Practices](https://wiki.sei.cmu.edu/confluence/display/seccode/Top+10+Secure+Coding+Practices), SEI CERT Coding Standards Wiki, 2018-05-02.\n\n**15.** GCC team, [GCC 15 Release Series Changes, New Features, and Fixes](https://gcc.gnu.org/gcc-15/changes.html), 2025-05-30.\n\n**16.** Wheeler, David, [Initial Analysis of Underhanded Source Code](https://www.ida.org/research-and-publications/publications/all/i/in/initial-analysis-of-underhanded-source-code), Institute for Defense Analysis, April 2020.\n\n**17.** Boucher, Nicholas and Anderson, Ross, [\u201cTrojan Source: Invisible Vulnerabilities\u201d](https://doi.org/10.48550/arXiv.2111.00169), arXiv:2111.00169 [cs.CR], 2021-10-30. \u53d1\u8868\u4e8e [32nd USENIX Security Symposium](https://www.usenix.org/conference/usenixsecurity23/presentation/boucher) (USENIX Security \u201823). \u66f4\u591a\u80cc\u666f\u89c1\uff1aKrebs, Brian\uff0c[\u2018Trojan Source\u2019 Bug Threatens the Security of All Code](https://krebsonsecurity.com/2021/11/trojan-source-bug-threatens-the-security-of-all-code/), KrebsOnSecurity, 2021-11-01\uff1b\u4ee5\u53ca[\u76f8\u5173 Hacker News \u8ba8\u8bba](https://news.ycombinator.com/item?id=29062982), Wikipedia \u8d21\u732e\u8005\uff0c[Trojan Source](https://en.wikipedia.org/w/index.php?title=Trojan_Source&oldid=1187570322), Wikipedia, 2023-11-01\uff1b\u4ee5\u53ca\u901a\u7528\u6f0f\u6d1e\u679a\u4e3e\u6570\u636e\u5e93\uff0c[CVE-2021-42574](https://www.cve.org/CVERecord?id=CVE-2021-42574), 2021-11-01.\n\n**18.** Voisin, Julien et al., [Default compiler hardening flags used to build packages for Linux distributions](https://github.com/jvoisin/compiler-flags-distro), GitHub jvoisin/compiler-flags-distro, 2025-02-14.\n\n**19.** Software in the Public Interest, [Hardening in Debian](https://wiki.debian.org/Hardening), Debian Wiki, 2022-01-07.\n\n**20.** Gentoo Foundation, [Hardening in Gentoo](https://wiki.gentoo.org/wiki/Hardened/Toolchain), Gentoo Wiki, 2023-03-08.\n\n**21.** Red Hat, [Using RPM build flags in Fedora](https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/buildflags.md), Fedora Package Sources ( `redhat-rpm-config` ), 2023-08-04.\n\n**22.** SUSE, [openSUSE Security Features](https://en.opensuse.org/openSUSE:Security_Features), openSUSE Wiki, 2022-12-8.\n\n**23.** Ubuntu, [Ubuntu Security Features](https://wiki.ubuntu.com/Security/Features), Ubuntu Wiki, 2023-08-07.\n\n**24.** LLVM team, [Controlling Diagnostics in System Headers](https://clang.llvm.org/docs/UsersManual.html#controlling-diagnostics-in-system-headers), Clang Compiler User\u2019s Manual, 2017-03-08.\n\n**25.** GCC team, [Options for Directory Search](https://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html), GCC Manual, 2023-07-27.\n\n**26.** LLVM team, [Clang command line argument reference\u00b6: -isystem<directory>](https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-isystem-directory), Clang documentation, 2017-09-05.\n\n**27.** Kitware, [include_directories\u00b6](https://cmake.org/cmake/help/latest/command/include_directories.html), Cmake Documentation, 2023-10-23.\n\n**28.** GCC team, [Using the GNU Compiler Collection (GCC): Warning Options.](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html), GCC Manual, 2023-07-27.\n\n**29.** LLVM Team, [Clang documentation: Diagnostics flags in Clang](https://clang.llvm.org/docs/DiagnosticsReference.html), Clang documentation, 2023-03-17.\n\n**30.** Taylor, Ian Lance, [The new Wconversion option](https://gcc.gnu.org/wiki/NewWconversion), GCC Wiki, 2012-01-06.\n\n**31.** Feske, Norman, [Let\u2019s make -Wconversion our new friend!](https://genodians.org/nfeske/2021-12-07-wconversion), Genode Labs, 2021-12-07.\n\n**32.** Stallman, Richard, [Nested Functions](https://www.gnu.org/software/c-intro-and-ref/manual/html_node/Nested-Functions.html), GNU C Language Introduction and Reference Manual, 2023-10-15.\n\n**33.** Polacek, Marek, [\u201c-Wimplicit-fallthrough in GCC 7\u201d](https://developers.redhat.com/blog/2017/03/10/wimplicit-fallthrough-in-gcc-7), Red Hat Developer, 2017-03-10\n\n**34.** Corbet, Jonathan. [\u201cAn end to implicit fall-throughs in the kernel\u201d](https://lwn.net/Articles/794944/), LWN, 2019-08-01.\n\n**35.** ISO/IEC, [Programming languages \u2014 C (\u201cC17\u201d)](https://web.archive.org/web/20181230041359/http://www.open-std.org/jtc1/sc22/wg14/www/abq/c17_updated_proposed_fdis.pdf), ISO/IEC 9899:2018, 2017. \u6ce8\uff1a\u5b98\u65b9 ISO/IEC \u89c4\u8303\u9700\u4ed8\u8d39\uff0c\u6545\u4e0d\u516c\u5f00\u53ef\u5f97\uff1b\u6700\u7ec8\u89c4\u8303\u8349\u6848\u53ef\u516c\u5f00\u83b7\u53d6\u3002\n\n**36.** Shafik, Yaghmour, [\u201cGCC 7, -Wimplicit-fallthrough warnings, and portable way to clear them?\u201d](https://stackoverflow.com/questions/27965722/c-force-compile-time-error-warning-on-implicit-fall-through-in-switch/27965827#27965827), StackOverflow, 2015-01-15.\n\n**37.** Howlett, Liam,[tools: Rename __fallthrough to fallthrough](https://github.com/torvalds/linux/commit/f7a858bffcddaaf70c71b6b656e7cc21b6107cec), Linux Kernel Source, 2023-04-07.\n\n**38.** GCC team, [GCC 7 Release Series Changes, New Features, and Fixes](https://gcc.gnu.org/gcc-7/changes.html), 2019-11-14.\n\n**39.** LLVM team, [Attributes in Clang: fallthrough, clang::fallthrough](https://releases.llvm.org/4.0.0/tools/clang/docs/AttributeReference.html#fallthrough-clang-fallthrough), Clang Documentation, 2017-03-13.\n\n**40.** GCC team, [GCC 5 Release Series Changes, New Features, and Fixes](https://gcc.gnu.org/gcc-5/changes.html), 2017-10-10.\n\n**41.** GCC team, [Using the GNU Compiler Collection (GCC): Warning Options: `-Wbidi-chars`](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wbidi-chars_003d),\n\n**42.** LLVM team, [clang-tidy - misc-misleading-bidirectional](https://clang.llvm.org/extra/clang-tidy/checks/misc/misleading-bidirectional.html), Extra Clang Tools Documentation, 2024-03-28.\n\n**43.** LLVM team, [clang-tidy - misc-confusable-identifiers](https://clang.llvm.org/extra/clang-tidy/checks/misc/confusable-identifiers.html), Extra Clang Tools Documentation, 2024-03-28.\n\n**44.** LLVM team, [clang-tidy - misc-misleading-identifier](https://clang.llvm.org/extra/clang-tidy/checks/misc/misleading-identifier.html), Extra Clang Tools Documentation, 2024-03-28.\n\n**45.** Johnston, Philip. [-Werror is Not Your Friend](https://embeddedartistry.com/blog/2017/05/22/werror-is-not-your-friend/). Embedded Artistry Blog, 2017-05-22.\n\n**46.** Weimer, Florian, [Porting to Modern C](https://fedoraproject.org/wiki/Changes/PortingToModernC), Fedora Project Wiki, 2023-12-22.\n\n**47.** scut [TESO], [Exploiting Format String Vulnerabilities](https://web.archive.org/web/20240402183013/https://cs155.stanford.edu/papers/formatstring-1.2.pdf), version 1.2, 2001-09-01.\n\n**48.** Arch Linux, [rfc/0003-buildflags.rst](https://gitlab.archlinux.org/archlinux/rfcs/-/blob/2136adc4a86afe37f351f8f564af3dcc6d7681ae/rfcs/0003-buildflags.rstt), ArchLinux RFC, 2023-09-03.\n\n**49.** Fedora, [Format-Security-FAQ](https://fedoraproject.org/wiki/Format-Security-FAQ), Fedora Wiki, 2013-12-05.\n\n**50.** Ubuntu, [ToolChain/CompilerFlags](https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-Wformat_-Wformat-security), Ubuntu Wiki, 2024-03-22.\n\n**51.** Carnegie Mellon University (CMU), [DCL31-C. Declare identifiers before using them](https://wiki.sei.cmu.edu/confluence/display/c/DCL31-C.+Declare+identifiers+before+using+them), SEI CERT C Coding Standard, 2023-10-09.\n\n**52.** Carnegie Mellon University (CMU), [INT36-C. Converting a pointer to integer or integer to pointer](https://wiki.sei.cmu.edu/confluence/display/c/INT36-C.+Converting+a+pointer+to+integer+or+integer+to+pointer), SEI CERT C Coding Standard, 2023-04-20.\n\n**53.** GCC team, [Porting to GCC 14](https://gcc.gnu.org/gcc-14/porting_to.html), GCC Supplementary Documentation, 2024-02-19.\n\n**54.** LLVM team, [Clang 15.0.0 Release Notes](https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html), Clang documentation, 2022-09-06.\n\n**55.** GCC team, [Using the GNU Compiler Collection (GCC): Warning Options: `-pedantic-errors`](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-pedantic-errors-1), GCC Manual, 2023-07-27.\n\n**56.** GNU C Library team, [Source Fortification in the GNU C Library](https://www.gnu.org/software/libc/manual/html_node/Source-Fortification.html), GNU C Library (glibc) manual, 2023-02-01.\n\n**57.** Poyarekar, Siddhesh, [How to improve application security using _FORTIFY_SOURCE=3](https://developers.redhat.com/articles/2023/02/06/how-improve-application-security-using-fortifysource3), Red Hat Developer, 2023-02-06.\n\n**58.** GCC team, [Arrays of Length Zero](https://gcc.gnu.org/onlinedocs/gcc/extensions-to-the-c-language-family/arrays-of-length-zero.html), GCC Manual (experimental 20221114 documentation), 2022-11-14.\n\n**59.** GCC team, [Using the GNU Compiler Collection (GCC): 6.62 Object Size Checking](https://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html), GCC Manual, 2024-08-01.\n\n**60.** LLVM team, [Clang Language Extensions: Evaluating Object Size](https://clang.llvm.org/docs/LanguageExtensions.html#evaluating-object-size), Clang Documentation, 2024-09-17.\n\n**61.** Linux Man Pages team, [malloc_usable_size(3)](https://man7.org/linux/man-pages/man3/malloc_usable_size.3.html), Linux manual page, 2023-03-30.\n\n**62.** kpcyrd, [Task Todo List Prepare packages for -D_FORTIFY_SOURCE=3](https://archlinux.org/todo/prepare-packages-for-d_fortify_source3/), Arch Linux Task Todo List, 2023-09-05.\n\n**63.** Ostapenko, Maxim, [Do not allow asan/msan/tsan and fortify at the same time.](https://inbox.sourceware.org/libc-alpha/57CDAB08.8060601@samsung.com/), GNU C Library mailing list, 2016-09-05.\n\n**64.** GCC team, [Using Macros in the GNU C++ Library](https://gcc.gnu.org/onlinedocs/libstdc++/manual/using_macros.html), The GNU C++ Library Manual, 2023-07-27.\n\n**65.** LLVM team, [Hardening Modes](https://libcxx.llvm.org/Hardening.html), libc++ documentation, 2026-02-24.\n\n**66.** GCC team, [Debug Mode](https://gcc.gnu.org/onlinedocs/libstdc++/manual/debug_mode.html), The GNU C++ Library Manual, 2025-08-08.\n\n**67.** Wakely, Jonathan, [Enable lightweight checks with _GLIBCXX_ASSERTIONS](https://patchwork.ozlabs.org/project/gcc/patch/20150907182755.GP2631@redhat.com/), GCC Mailing List, 2015-09-07\n\n**68.** Metzger-Kraus, Christof. [Don\u2019t use GLIBCXX_ASSERTIONS in production](https://gitlab.psi.ch/OPAL/src/-/merge_requests/468), Object Oriented Particle Accelerator Library (OPAL) Issue Tracker, 2021-01-16.\n\n**69.** LLVM team, [Hardening Modes: Assertion categories](https://libcxx.llvm.org/Hardening.html#assertion-categories), libc++ documentation, 2026-02-24.\n\n**70.** LLVM team, [Hardening Modes: ABI options](https://libcxx.llvm.org/Hardening.html#abi-options), libc++ documentation, 2026-02-24.\n\n**71.** GCC team, [Using the GNU Compiler Collection (GCC): Warning Options: `-Wstrict-flex-arrays`](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstrict-flex-arrays), GCC Manual, 2023-07-27.\n\n**72.** Guelton, Serge, [The benefits and limitations of flexible array members](https://developers.redhat.com/articles/2022/09/29/benefits-limitations-flexible-array-members), Red Hat Developer, 2022-09-29.\n\n**73.** Cook, Kees, [GCC Bug 101836 - `__builtin_object_size(P->M, 1) where M is an array and the last member of a struct fails`](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836), GCC Bugzilla, 2021-08-09.\n\n**74.** GCC team, [Program Instrumentation Options: `-Wsanitize=bounds`](https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fsanitize_003dbounds), GCC Manual, 2023-07-27.\n\n**75.** Corbet, Jonathan, [\u201cGCC features to help harden the kernel\u201d](https://lwn.net/Articles/946041/), LWN, 2023-09-05.\n\n**76.** Zhao, Qing, \u201c[[GCC13][Patch][V2][1/2]Add a new option -fstrict-flex-array[=n] and attribute strict_flex_array(n) and use it in PR101836\u201d](https://gcc.gnu.org/pipermail/gcc-patches/2022-August/599151.html), GCC Mailing List, 2022-08-01.\n\n**77.** Edge, Jake, [Safer flexible arrays for the kernel](https://lwn.net/Articles/908817/), LWN, 2022-09-22.\n\n**78.** Cook, Kees, and Gustavo A.R. Silva, [\u201cProgress on Bounds Checking in C and the Linux Kernel\u201d](https://www.youtube.com/watch?v=V2kzptQG5_A), Linux Security Summit North America 2023, 2023-05-12.\n\n**79.** Hebb, Tom, [GCC\u2019s -fstack-protector fails to guard dynamic stack allocations on ARM64](https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf), GitHub metaredteam/external-disclosures Advisories, 2023-09-12.\n\n**80.** Arm, [GCC Stack Protector Vulnerability AArch64](https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64), Arm Security Center, 2023-09-12.\n\n**81.** Common Vulnerability Enumeration Database, [CVE-2023-4039](https://www.cve.org/CVERecord?id=CVE-2023-4039), 2023-09-13.\n\n**82.** Shen, Han, [New stack protector option for gcc](https://docs.google.com/document/d/1xXBH6rRZue4f296vGt9YQcuLVQHeE516stHwt8M9xyU), Google Docs, 2011-11-30.\n\n**83.** GCC team, [GCC 14 Release Series Changes, New Features, and Fixes](https://gcc.gnu.org/gcc-14/changes.html), 2024-08-10.\n\n**84.** Intel, [\u201cA Technical Look at Intel\u2019s Control-flow Enforcement Technology\u201d](https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html), 2020-06-13.\n\n**85.** ARM Developer, [Arm Compiler armclang Reference Guide version 6.24 -mbranch-protection](https://developer.arm.com/documentation/101754/0624/armclang-Reference/armclang-Command-line-Options/-mbranch-protection), 2025-03-28.\n\n**86.** ARM Developer, [Examples for the armclang -mbranch-protection command-line option, version 6.24](https://developer.arm.com/documentation/101754/0624/armclang-Reference/armclang-Command-line-Options/Examples-for-the-armclang--mbranch-protection-command-line-option), 2025-03-28.\n\n**87.** GNU C Library team, [Tunables](https://www.gnu.org/software/libc/manual/html_node/Tunables.html), GNU C Library (glibc) manual, 2024-07-22.\n\n**88.** GCC team, [Using the GNU Compiler Collection (GCC): Optimize Options: `-fzero-call-used-regs`](https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fzero-call-used-regs), GCC Manual, \u68c0\u7d22\u4e8e 2026-07-14.\n\n**89.** Cook, Kees, [hardening: Introduce CONFIG_ZERO_CALL_USED_REGS](https://git.kernel.org/linus/a82adfd5c7cb), Linux kernel commit `a82adfd5c7cb` , 2021-07-20. \u542f\u7528 `CONFIG_ZERO_CALL_USED_REGS` \u65f6\uff0c\u5185\u6838\u4ee5 `-fzero-call-used-regs=used-gpr` \u6784\u5efa\uff1b\u6b64\u5904\u5f15\u7528\u7684 gadget \u6570\u91cf\u3001\u6027\u80fd\u4e0e\u955c\u50cf\u4f53\u79ef\u6570\u636e\u6765\u81ea\u8be5\u63d0\u4ea4\u8bf4\u660e\uff0c\u4ee5\u53ca `security/Kconfig.hardening` \u4e2d `ZERO_CALL_USED_REGS` \u7684\u5e2e\u52a9\u6587\u672c\u3002\n\n**90.** Bj\u00f6rklund, Jerker, [Gadget reduction using zero-call-user-regs](https://www.jerkeby.se/newsletter/posts/rop-reduction-zero-call-user-regs/), 2021-11-26.\n\n**91.** GCC team, [Using the GNU Compiler Collection (GCC): Common Function Attributes: `zero_call_used_regs`](https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html), GCC Manual, \u68c0\u7d22\u4e8e 2026-07-14. \u8be5\u9009\u9879\u4e0e\u540c\u540d\u5c5e\u6027\u63a5\u53d7\u76f8\u540c\u7684\u53d6\u503c\u3002`leafy` \u7cfb\u5217\u53d6\u503c\u81ea GCC 14 \u624b\u518c\u8d77\u624d\u6709\u6587\u6863\u8bb0\u8f7d\uff1bGCC 11 \u624b\u518c\u53ea\u8bb0\u8f7d\u4e86 `skip`\u3001`used` \u4e0e `all` \u7cfb\u5217\u3002\n\n**92.** Clang \u5728 15.0.0 \u4e2d\u65b0\u589e\u4e86\u5bf9 `-fzero-call-used-regs` \u7684\u652f\u6301\uff08LLVM team\uff0c[Clang 15.0.0 Release Notes](https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html), 2022-09-06\uff09\uff0c\u4f46\u8be5\u5b9e\u73b0\u53ef\u80fd\u751f\u6210\u975e\u6cd5\u4ee3\u7801\uff0c\u5bfc\u81f4\u7a7a\u6307\u9488\u89e3\u5f15\u7528\uff08LLVM team\uff0c[clang-15: May produce invalid code when -O1 (or higher) is used with -fzero-call-used-regs=all](https://github.com/llvm/llvm-project/issues/57692), LLVM issue tracker, 2022-09-12\uff09\u3002\u56e0\u6b64 Linux \u5185\u6838\u628a `CONFIG_CC_HAS_ZERO_CALL_USED_REGS` \u9650\u5236\u4e3a GCC \u6216\u9ad8\u4e8e 15.0.6 \u7684 Clang\uff0c\u4fee\u590d\u5305\u542b\u5728 Clang 16.0.0 \u4e2d\uff08Chancellor, Nathan\uff0c[security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6](https://git.kernel.org/linus/d6a9fb87e9d1), Linux kernel commit `d6a9fb87e9d1` , 2022-12-15\uff09\u3002\u53ea\u6709\u5f53\u5185\u6838\u6700\u4f4e\u652f\u6301\u7684 Clang \u7248\u672c\u9ad8\u4e8e\u8be5\u7248\u672c\u540e\uff0c\u6b64\u9650\u5236\u624d\u88ab\u79fb\u9664\uff08Chancellor, Nathan\uff0c[security/Kconfig.hardening: Remove tautological condition from CC_HAS_ZERO_CALL_USED_REGS](https://git.kernel.org/linus/813fe686e90b), Linux kernel commit `813fe686e90b` , 2026-05-27\uff09\u3002\n\n**93.** LLVM team, [Clang command line argument reference: `-fzero-call-used-regs`](https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-fzero-call-used-regs), Clang documentation, \u68c0\u7d22\u4e8e 2026-07-14. Clang 22 \u53ca\u66f4\u65e9\u7248\u672c\u7684\u53c2\u8003\u6587\u6863\u628a\u8be5\u9009\u9879\u63cf\u8ff0\u4e3a\u201c\u4ec5 AArch64/x86\u201d\uff1bRISC-V \u662f\u5728 Clang 23 \u5f00\u53d1\u7248\u6587\u6863\u4e2d\u88ab\u52a0\u5165\u53d7\u652f\u6301\u76ee\u6807\u7684\u3002\n\n**94.** GCC \u7528\u901a\u7528\u9ed8\u8ba4\u5b9e\u73b0\uff08\u4f4d\u4e8e [`gcc/targhooks.cc`](https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/targhooks.cc) \u7684 `default_zero_call_used_regs`\uff09\u6765\u5b9e\u73b0 `TARGET_ZERO_CALL_USED_REGS` \u76ee\u6807\u94a9\u5b50\uff0c\u5176\u505a\u6cd5\u662f\u5411\u5bc4\u5b58\u5668\u8f7d\u5165\u96f6\u6765\u6e05\u7a7a\u5b83\u4eec\uff1b\u5728\u76ee\u6807\u7279\u5b9a\u5e8f\u5217\u66f4\u53ef\u53d6\u4e4b\u5904\uff0c\u5404\u540e\u7aef\u4f1a\u8986\u76d6\u8be5\u9ed8\u8ba4\u5b9e\u73b0\uff1bx86\u3001SPARC \u4e0e RISC-V \u63d0\u4f9b\u4e86\u8986\u76d6\uff08`gcc/config/i386/i386.cc`\u3001`gcc/config/sparc/sparc.cc`\u3001`gcc/config/riscv/riscv.cc`\uff09\uff0cGCC \u6e90\u7801\uff0c\u68c0\u7d22\u4e8e 2026-07-14\u3002\n\n**95.** OpenSSH team, [`configure.ac`](https://github.com/openssh/openssh-portable/blob/master/configure.ac), OpenSSH Portable, \u68c0\u7d22\u4e8e 2026-07-14. \u6784\u5efa\u65f6\u9009\u7528 `-fzero-call-used-regs=used`\uff0c\u4e14\u4ec5\u5bf9 Clang 17 \u8df3\u8fc7\u8be5\u9009\u9879\u3002\u8be5\u5185\u90e8\u7f16\u8bd1\u5668\u9519\u8bef\u89c1 LLVM team\uff0c[Clang-17 gets an internal error while building OpenSSH-9.5-P1 due to -fzero-call-used-regs](https://github.com/llvm/llvm-project/issues/69794), LLVM issue tracker, 2023-10-21\uff1b\u62a5\u544a\u6307\u51fa\u540c\u4e00 OpenSSH \u7248\u672c\u7528 Clang 16.0.5 \u53ef\u6210\u529f\u6784\u5efa\uff0c\u800c LLVM \u7ef4\u62a4\u8005\u672a\u80fd\u5728 Linux \u4e0a\u590d\u73b0\u8be5\u5931\u8d25\u3002\u8fd9\u4e0e\u4e0a\u6587\u63cf\u8ff0\u7684 Clang 15 \u4ee3\u7801\u751f\u6210\u7f3a\u9677\u662f\u4e0d\u540c\u95ee\u9898\uff0c\u540e\u8005\u4ea7\u751f\u7684\u662f\u975e\u6cd5\u4ee3\u7801\u800c\u975e\u6784\u5efa\u5931\u8d25\u3002\n\n**96.** GCC team, [Support for Nested Functions.](https://gcc.gnu.org/onlinedocs/gccint/Trampolines.html), GCC Internals, 2023-07-27.\n\n**97.** Hernandez, Alejandro, [A Short Tale About executable_stack in elf_read_implies_exec() in the Linux Kernel](https://ioactive.com/a-short-tale-about-executable_stack-in-elf_read_implies_exec-in-the-linux-kernel/), IOActive, 2013-11-27.\n\n**98.** Cook, Kees, [x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9fccc5c0c99f238aa1b0460fccbdb30a887e7036), Linux Kernel Source, 2020-03-26.\n\n**99.** Bendersky, Eli, [Position Independent Code (PIC) in shared libraries](https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/), Eli Bendersky\u2019s website, 2011-11-03.\n\n**100.** Bendersky, Eli. [Position Independent Code (PIC) in shared libraries on x64](https://eli.thegreenplace.net/2011/11/11/position-independent-code-pic-in-shared-libraries-on-x64), Eli Bendersky\u2019s website, 2011-11-11.\n\n**101.** Wang, Xi, Haogang Chen, Alvin Cheung, Zhihao Jia, Nickolai Zeldovich, and M. Frans Kaashoek, 2012, \u201cUndefined Behavior:What Happened to My Code?\u201d, APSys \u201812, ACM, [https://pdos.csail.mit.edu/papers/ub:apsys12.pdf](https://pdos.csail.mit.edu/papers/ub:apsys12.pdf)\n\n**102.** Zdrnja, Bojan Zdrnja, 2009-07-17, A new fascinating Linux kernel vulnerability, [https://isc.sans.edu/diary/A+new+fascinating+Linux+kernel+vulnerability/6820](https://isc.sans.edu/diary/A+new+fascinating+Linux+kernel+vulnerability/6820)\n\n**103.** Torvalds, Linus, 2018-04-04, [https://lkml.org/lkml/2018/4/4/601](https://lkml.org/lkml/2018/4/4/601)\n\n**104.** ISO/IEC, [Programming languages \u2014 C (\u201cC23\u201d)](https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3220.pdf), ISO/IEC ISO/IEC 9899:2024, 2024. \u6ce8\uff1a\u5b98\u65b9 ISO/IEC \u89c4\u8303\u9700\u4ed8\u8d39\uff0c\u6545\u4e0d\u516c\u5f00\u53ef\u5f97\uff1b\u6700\u7ec8\u89c4\u8303\u8349\u6848\u53ef\u516c\u5f00\u83b7\u53d6\u3002\n\n**105.** ISO/IEC, [Programming languages \u2014 C++ (\u201cC++20\u201d)](https://isocpp.org/files/papers/N4860.pdf), ISO/IEC ISO/IEC 14882:2020, 2022. \u6ce8\uff1a\u5b98\u65b9 ISO/IEC \u89c4\u8303\u9700\u4ed8\u8d39\uff0c\u6545\u4e0d\u516c\u5f00\u53ef\u5f97\uff1b\u6700\u7ec8\u89c4\u8303\u8349\u6848\u53ef\u516c\u5f00\u83b7\u53d6\u3002\n\n**106.** Bastien, JF, [P3477R0: There are exactly 8 bits in a byte](https://open-std.org/JTC1/SC22/WG21/docs/papers/2024/p3477r0.html), Published ISO/IEC JTC1/SC22/WG21 Proposal, 2024-10-15.\n\n**107.** Bastien, JF, [P0907R4: Signed Integers are Two\u2019s Complement](https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p0907r4.html), Published ISO/IEC JTC1/SC22/WG21 Proposal, 2018-10-06\n\n**108.** GCC team, [Options That Control Optimization: -flto](https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto), GCC Manual, 2024-05-07.\n\n**109.** GCC team, [Options That Control Optimization: `-ftrivial-auto-var-init`](https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-ftrivial-auto-var-init), GCC Manual, 2025-05-30..\n\n**110.** Valgrind Developers, [Valgrind](https://valgrind.org/), 2025-05-20.\n\n**111.** Dr. memory team, [Dr. Memory](https://drmemory.org/), 2025-04-11.\n\n**112.** LLVM Sanitizers team, [NemorySanitizer](https://github.com/google/sanitizers/wiki/memorysanitizerr), GitHub google/sanitizers Wiki, 2024-06-09.\n\n**113.** Arm, [Arm Compiler for Embedded Reference Guide: `-ftrivial-auto-var-init`](https://developer.arm.com/documentation/101754/0624/armclang-Reference/armclang-Command-line-Options/-ftrivial-auto-var-init), Arm Compiler for Embedded Reference Guide, Version 6.24, 2025-05-31.\n\n**114.** Kerrisk, Michael, [pthread_cancel](https://man7.org/linux/man-pages/man3/pthread_cancel.3.html), man7.org, 2023-12-22.\n\n**115.** Weimer, Florian, [[PATCH] pthread_cleanup_push macro generates warning when -Wclobbered is set](https://sourceware.org/pipermail/libc-alpha/2017-November/088474.html), Libc-alpha mailing list, 2017-11-14.\n\n**116.** Weimer, Florian, [[11/12/13/14 Regression] Indirect call generated for pthread_cleanup_push with constant cleanup function](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61118#c13), GCC Bugzilla, 2017-11-21.\n\n**117.** Weimer, Florian, [Recommended compiler and linker flags for GCC](https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-gcc), Red Hat Developer, 2018-03-21.\n\n**118.** GCC team, [Program Instrumentation Options: `-fhardened`](https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fhardened), GCC Manual, 2024-05-07.\n\n**119.** Software in the Public Interest, [ToolChain DSOLinking](https://wiki.debian.org/ToolChain/DSOLinking), Debian Wiki, 2018-10-14.\n\n**120.** Berkholz, Donnie, [Bug 234710 - as-needed by default](https://bugs.gentoo.org/234710), Gentoo\u2019s Bugzilla, 2008-08-14.\n\n**121.** Gentoo Foundation, [Project:Quality Assurance/As-needed](https://wiki.gentoo.org/wiki/Project:Quality_Assurance/As-needed), Gentoo Wiki, 2022-07-22.\n\n**122.** Kerrisk, Michael, [Building and Using Shared Libraries on Linux, Shared Libraries: The Dynamic Linker](https://man7.org/training/download/shlib_dynlinker_slides.pdf), man7.org, February 2023.\n\n**123.** Kratochvil, Jan, [Memory error checking in C and C++: Comparing Sanitizers and Valgrind](https://developers.redhat.com/blog/2021/05/05/memory-error-checking-in-c-and-c-comparing-sanitizers-and-valgrind), Red hat Developers, 2021-05-05.\n\n**124.** Nagy , Szabolcs, [Address Sanitizer local root](https://www.openwall.com/lists/oss-security/2016/02/17/9), Openwall mailing list, 2016-02-16.\n\n**125.** LLVM Sanitizers team, [AddressSanitizerFlags](https://github.com/google/sanitizers/wiki/AddressSanitizerFlags), GitHub google/sanitizers Wiki, 2019-05-15.\n\n**126.** LLVM Sanitizers team, [AddressSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizer), GitHub google/sanitizers Wiki, 2019-05-15.\n\n**127.** LLVM Sanitizers team, [ThreadSanitizerFlags](https://github.com/google/sanitizers/wiki/ThreadSanitizerFlags), GitHub google/sanitizers Wiki, 2015-08-31.\n\n**128.** LLVM Sanitizers team, [ThreadSanitizerReportFormat](https://github.com/google/sanitizers/wiki/ThreadSanitizerReportFormat), GitHub google/sanitizers Wiki, 2015-08-31.\n\n**129.** GCC team, [Program Instrumentation Options](https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#Instrumentation-Options), GCC Manual, 2023-07-27.\n\n**130.** LLVM team, [UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html), Clang documentation, 2023-03-17.\n\n**131.** DWARF Debugging Information Format Committee, [DWARF Version 5 Debugging Format Standard](https://dwarfstd.org/dwarf5std.html), DWARF Debugging Standard Website, 2017-02-13.\n\n**132.** Linux Foundation, [Linux Standard Base Core Specification, Generic Part, Chapter 10.8. ABI note tag.](https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/noteabitag.html), Linux Foundation Referenced Specifications, 2015-05-27.\n\n**133.** Binutils team, [LD Options](https://sourceware.org/binutils/docs/ld/Options.html#Options), Documentation for binutils, 2023-07-30.\n\n**134.** US NSA, [Ghidra homepage](https://ghidra-sre.org/)\n\n**135.** Hex-Rays, [IDA Pro homepage](https://www.hex-rays.com/products/ida)\n\n**136.** Binutils team, [objcopy](https://sourceware.org/binutils/docs/binutils/objcopy.html), Documentation for binutils, 2023-07-30.\n\n**137.** LLVM team, [llvm-objcopy](https://llvm.org/docs/CommandGuide/llvm-objcopy.html), LLVM Command Guide, 2023-03-17.\n\n**138.** Binutils team, [strip](https://sourceware.org/binutils/docs/binutils/strip.html), Documentation for binutils, 2023-07-30.\n\n**139.** LLVM team, [llvm-strip](https://llvm.org/docs/CommandGuide/llvm-strip.html), LLVM Command Guide, 2023-03-17.\n\n**140.** GDB team, [Debugging Information in Separate Files](https://sourceware.org/gdb/onlinedocs/gdb/Separate-Debug-Files.html), Debugging with GDB, 2023-08-16.\n\n**141.** LLVM team, [Configuration files](https://clang.llvm.org/docs/UsersManual.html#configuration-files), Clang Compiler User\u2019s Manual, 2024-09-17.\n\n**142.** Clifton, Nick, [The linker\u2019s warnings about executable stacks and segments](https://www.redhat.com/en/blog/linkers-warnings-about-executable-stacks-and-segments), Red Hat Blog, 2022-09-14.\n\n**143.** `-Wl,-z,nodump` \u9009\u9879\u4f1a\u5728\u5bf9\u8c61\u7684 `.dynamic` \u6bb5\u6807\u7b7e\u4e2d\u8bbe\u7f6e `DF_1_NODUMP` \u6807\u5fd7\u3002\u5728 Solaris \u4e0a\uff0c\u8fd9\u4f1a\u9650\u5236\u5bf9\u8be5\u5bf9\u8c61\u8c03\u7528 `dldump(3)`\u3002\u4f46\u5176\u4ed6\u64cd\u4f5c\u7cfb\u7edf\u4f1a\u5ffd\u7565 `DF_1_NODUMP` \u6807\u5fd7\u3002\u867d\u7136 Binutils \u4e3a\u517c\u5bb9 Solaris \u5b9e\u73b0\u4e86 `-Wl,-z,nodump`\uff0c\u4f46\u51b3\u5b9a\u4e0d\u5728 `lld` \u4e2d\u652f\u6301\u5b83\uff08[D52096 lld: add -z nodump support](https://reviews.llvm.org/D52096)\uff09\u3002\n\n**144.** `-Wl,-z,noexecheap` \u662f\u4ece [PaX](https://pax.grsecurity.net/) \u79fb\u690d\u5230 Binutils \u7684 [Hardened Gentoo](https://wiki.gentoo.org/wiki/Hardened/PaX_Quickstart) \u6269\u5c55\u3002PaX \u662f\u5bf9 Linux \u5185\u6838\u4e0e Binutils \u7684\u8865\u4e01\uff0c\u5b83\u4e3a ELF \u5bf9\u8c61\u6dfb\u52a0 `PT_PAX_FLAGS` \u7a0b\u5e8f\u5934\uff0c\u7528\u4e8e\u5b58\u653e PaX \u5185\u6838\u53ef\u5f3a\u5236\u6267\u884c\u7684\u5185\u5b58\u4fdd\u62a4\u4fe1\u606f\u3002\u5b58\u653e\u5728 `PT_PAX_FLAGS` \u4e2d\u7684\u4fdd\u62a4\u4fe1\u606f\u5bf9\u8fd0\u884c\u5728\u65e0 PaX \u5185\u6838\u7cfb\u7edf\u4e0a\u7684\u8f6f\u4ef6\u6ca1\u6709\u76ca\u5904\u3002\u81ea 2.15 \u8d77\u5404\u7248\u672c Binutils \u7684 Gentoo \u8865\u4e01\uff08`63_all_binutils-<version>-pt-pax-flags-<date>.patch`\uff09\u53ef\u5728 [https://dev.gentoo.org/~vapier/dist/](https://dev.gentoo.org/~vapier/dist/) \u627e\u5230\u3002\n\n**145.** LLVM libc++ \u7684\u201csafe\u201d\u8fd0\u884c\u6a21\u5f0f\u7ecf\u5386\u8fc7\u591a\u8f6e\u8bbe\u8ba1\u8fed\u4ee3\u3002\u4ece libc++ 17.0.0 \u8d77\uff0c\u201csafe\u201d\u6a21\u5f0f\u88ab\u5e9f\u5f03\uff0c\u4ee3\u4e4b\u4ee5\u65b0\u7684\u52a0\u56fa\u6a21\u5f0f\uff0c\u540e\u8005\u63d0\u4f9b\u8303\u56f4\u66f4\u7a84\u7684\u4e00\u7ec4\u68c0\u67e5\uff08\u6027\u80fd\u8db3\u4ee5\u7528\u4e8e\u751f\u4ea7\u73af\u5883\u7684\u5b89\u5168\u5173\u952e\u68c0\u67e5\uff09\u3002\u66f4\u591a\u4fe1\u606f\u89c1\uff1aLLVM team, [Libc++ 17.0.0 Release Notes](https://libcxx.llvm.org/ReleaseNotes/17.html#deprecations-and-removals), Libc++ documentation, 2023-07-27; LLVM Team, [Hardened Mode](https://libcxx.llvm.org/Hardening.html), Libc++ documentation, 2023-07-27 and Varlamov, Konstatin, [Deprecate `_LIBCPP_ENABLE_ASSERTIONS`](https://reviews.llvm.org/D154997), LLVM Phabricator, 2022-07-11.\n\n**146.** GCC team, [x86 Built-in Functions](https://gcc.gnu.org/onlinedocs/gcc/x86-Built-in-Functions.html), GCC Manual, 2023-07-27.\n\n**147.** LLVM team, [SafeStack](https://clang.llvm.org/docs/SafeStack.html), Clang documentation, 2023-11-14.\n\n**148.** Song, Fangrui, [Stack unwinding](https://maskray.me/blog/2020-11-08-stack-unwinding), MaskRay blog, 2020-11-18.\n\n**149.** Bastian, Th\u00e9ophile and Kell, Stephen and Nardelli, Francesco Zappa, [Reliable and fast DWARF-based stack unwinding](https://doi.org/10.1145/3360572), Proceedings of the ACM Journal of Programming Languages, Volume 3, Issue OOPSLA, Article 146, 2019-10-10.\n\n**150.** Tice, Caroline, [Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM](https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-tice.pdf#page=12) USENIX Security, August 2014\n\n**151.** Gentoo Foundation, [Local Use Flag: vtv](https://packages.gentoo.org/useflags/vtv) Gentoo Packages, \u68c0\u7d22\u4e8e 2024-06-27.\n\n**152.** GCC team, [Using the GNU Compiler Collection (GCC): x86 Options: `-mmitigate-rop`](https://gcc.gnu.org/onlinedocs/gcc-6.1.0/gcc/x86-Options.html#index-mmitigate-rop-2936), GCC Manual, 2016-04-27.\n\n**153.** Bizjak, Uros [[RFC PATCH, i386]: Deprecate `-mmitigate-rop`](https://gcc.gnu.org/pipermail/gcc-patches/2018-August/504637.html), GCC Mailing List, 2018-08-15.\n\n**154.** Taylor, Ian Lance, [Split Stacks in GCC](https://gcc.gnu.org/wiki/SplitStacks), GCC Wiki, 2011-02-07.\n\n**155.** Taylor, Ian Lance, [gccgo split stack implementation](https://groups.google.com/g/golang-dev/c/QBCN9XVkwFk/m/7DgP2Iu_USkJ), golang-dev Google Groups, 2015-07-10.\n\n---\n\n\u539f\u6587\uff1a[\u9762\u5411 C \u4e0e C++ \u7684\u7f16\u8bd1\u5668\u9009\u9879\u52a0\u56fa\u6307\u5357](https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html) \u00b7 OpenSSF Best Practices Working Group \u00b7 2026-08-20\n", "url": "https://gist.github.com/occam-7/7089a0904cc8d4a42351e5df9b2afe41"}]}