git: 690207d4efc1 - stable/15 - build: provide a FORTIFY_SOURCE.<src file> override

The branch stable/15 has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=690207d4efc1560bf3fced49065c1ce621a2c67f

commit 690207d4efc1560bf3fced49065c1ce621a2c67f
Author:     Kyle Evans <[email protected]>
AuthorDate: 2026-06-17 22:40:46 +0000
Commit:     Kyle Evans <[email protected]>
CommitDate: 2026-08-06 23:34:41 +0000

    build: provide a FORTIFY_SOURCE.<src file> override
    
    For native files we can do more minimal fixes to avoid this large of a
    hammer, but for third party files it may not be worth the effort to try
    and patch them.  NetBSD has the original _FORTIFY_SOURCE implementation
    that ours is based on, for instance, but tests sourced from there can't
    do an __ssp_real(foo) without being certain that `foo` actually has a
    fortified definition.
    
    This change does always define _FORTIFY_SOURCE as a result, so gate it
    on CFLAGS not already containing _FORTIFY_SOURCE definitions.
    
    This re-applies c46a0b59071614, but without re-defining _FORTIFY_SOURCE
    needlessly.
    
    PR:             294881
    Reviewed by:    markj, sjg (both previous version)
    
    (cherry picked from commit 13184a69faa700319ab16357cd39708a0e89fc15)
---
 share/mk/bsd.sys.mk | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/share/mk/bsd.sys.mk b/share/mk/bsd.sys.mk
index d58830ad48c7..ed04825f575f 100644
--- a/share/mk/bsd.sys.mk
+++ b/share/mk/bsd.sys.mk
@@ -306,9 +306,6 @@ CLANG_OPT_SMALL+= -mllvm -simplifycfg-dup-ret
 CLANG_OPT_SMALL+= -mllvm -enable-load-pre=false
 CFLAGS.clang+=	 -Qunused-arguments
 
-# XXX This should be defaulted to 2 when WITH_SSP is in use after further
-# testing and soak time.
-FORTIFY_SOURCE?=	0
 .if ${MK_SSP} != "no"
 # Don't use -Wstack-protector as it breaks world with -Werror.
 .if ${COMPILER_FEATURES:Mstackclash}
@@ -318,9 +315,19 @@ SSP_CFLAGS?=	-fstack-protector-strong
 .endif
 CFLAGS+=	${SSP_CFLAGS}
 .endif # SSP
-.if ${FORTIFY_SOURCE} > 0
-CFLAGS+=	-D_FORTIFY_SOURCE=${FORTIFY_SOURCE}
-CXXFLAGS+=	-D_FORTIFY_SOURCE=${FORTIFY_SOURCE}
+
+# XXX This should be defaulted to 2 when WITH_SSP is in use after further
+# testing and soak time.
+FORTIFY_SOURCE?=	0
+
+# We want to avoid defining _FORTIFY_SOURCE if it's set to 0, but we rely on
+# deferred-evaluation for ${.IMPSRC} to expand.  The below construction
+# is, unfortunately, necessary.
+.if empty(CFLAGS:M-D_FORTIFY_SOURCE*)
+CFLAGS+=	${FORTIFY_SOURCE.${.IMPSRC:T}:U${FORTIFY_SOURCE}:S/^/-D_FORTIFY_SOURCE=/:N*=0}
+.endif
+.if empty(CXXFLAGS:M-D_FORTIFY_SOURCE*)
+CXXFLAGS+=	${FORTIFY_SOURCE.${.IMPSRC:T}:U${FORTIFY_SOURCE}:S/^/-D_FORTIFY_SOURCE=/:N*=0}
 .endif
 
 # Additional flags passed in CFLAGS and CXXFLAGS when MK_DEBUG_FILES is