[PATCH] netpbm: Fix hardening

[PATCH] netpbm: Fix hardening

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 2054 bytes --]

* Add some additional CFLAGS to workaround a gcc bug
  with enabled SSP.

* Add patch to proper use our LDFLAGS when linking libnetpbm.

* Disable stripping the binaries during install.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 netpbm/netpbm.nm                                  |  9 ++++++++-
 netpbm/patches/netpbm-libnetpbm-use-ldflags.patch | 12 ++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 netpbm/patches/netpbm-libnetpbm-use-ldflags.patch

diff --git a/netpbm/netpbm.nm b/netpbm/netpbm.nm
index 49488e5fa..cbafb517c 100644
--- a/netpbm/netpbm.nm
+++ b/netpbm/netpbm.nm
@@ -5,7 +5,7 @@
 
 name       = netpbm
 version    = 10.73.42
-release    = 1
+release    = 2
 
 groups     = System/Libraries
 url        = https://netpbm.sourceforge.net/
@@ -37,6 +37,10 @@ build
 		perl(English)
 	end
 
+	CFLAGS += \
+		-fno-builtin-exit \
+		-D__noreturn__=
+
 	prepare_cmds
 		# Create config file.
 		cp -avf config.mk.in  config.mk
@@ -58,6 +62,9 @@ build
 		echo 'JPEGHDR_DIR = %{includedir}' >> config.mk
 		echo 'PNGHDR_DIR = %{includedir}' >> config.mk
 		echo 'ZHDR_DIR = %{includedir}' >> config.mk
+
+		# Do not strip the binaries during install.
+		echo 'STRIPFLAG =' >> config.mk
 	end
 
 	build
diff --git a/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch
new file mode 100644
index 000000000..21384cb26
--- /dev/null
+++ b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch
@@ -0,0 +1,12 @@
+diff -Nur a/lib/Makefile b/lib/Makefile
+--- a/lib/Makefile	2019-06-29 01:07:55.000000000 +0200
++++ b/lib/Makefile	2023-03-12 09:21:25.558949353 +0100
+@@ -128,7 +128,7 @@
+ 	rm -f $@
+ 	$(SYMLINK) $< $@
+ libnetpbm.$(NETPBMLIBSUFFIX).$(MAJ).$(MIN): $(LIBOBJECTS) $(LIBOBJECTS_X)
+-	$(LD) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \
++	$(LD) $(LDFLAGS) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \
+           $(SHLIB_CLIB) -lm $(LADD)
+ endif
+ 
-- 
2.30.2