patchmingw: enable GCC's stack smashing protector

Recently, I managed to upstream the Data Execution Prevention/Address Space Layout Randomization patches of Git for Windows. Now it is time to add to that by also enabling GCC's augmenting feature which reduces the attack surface even further.

Johannes Schindelin (1):
  mingw: enable stack smashing protector

 config.mak.uname | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

base-commit: aa25c82427ae70aebf3b8f970f2afd54e9a2a8c6
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-215%2Fdscho%2Fmingw-stack-smashing-protector-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-215/dscho/mingw-stack-smashing-protector-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/215

From: Johannes Schindelin <johannes.schindelin@gmx.de>

To reduce Git for Windows' attack surface, we started using the Address Space Layout Randomization and Data Execution Prevention features in ce6a158561f9 (mingw: enable DEP and ASLR, 2019-05-08).

To remove yet another attack vector, let's make use of gcc's stack smashing protector that helps detect stack buffer overruns early.

Rather than using -fstack-protector, we use -fstack-protector-strong because on Windows: The latter appears to strike a better balance between the performance impact and the provided safety.

In a non-scientific test (time git log --grep=is -p), best of 5 timings went from 23.009s to 22.997s, i.e. the performance impact was *well* lost in the noise.

This fixes https://github.com/git-for-windows/git/issues/501

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 config.mak.uname | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)