Security-related flags and options for C compilers in python
This guide is intended to help you determine which flags you should use to compile your C Code using GCC, Clang or MSVC, in order to:
- detect the maximum number of bugs or potential security problems.
- enable security mitigations in the produced binaries.
- enable runtime sanitizers to detect errors (overflows, race conditions, etc.) and make fuzzing more efficient.
Disclaimer:
The flags selected and recommended here were chosen to maximize the number of classes of detected errors which could have a security benefit when enabled. Code generation options (such as -fstack-protector-strong) can also have performance impacts. It is up to you to assess the impact on your code base and choose the right set of command line options.
Comments are of course welcome.
GCC TL;DR
Always use the following warnings and flags