From d668c4b78beff721d8a2616c9f4f749cb59281eb Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sun, 22 Feb 2026 16:25:43 +0100
Subject: [PATCH] Hardening: add -fstrict-flex-arrays=3 This should help
 gcc/clang with finding more OOB write bugs.

It does mean that 3rd party modules can no longer use the something like:
struct { char name[1]; }
and then alloc(sizeof(struct) + length of name)

instead the struct element needs to be name[];
...and they would need to alloc(sizeof(struct) + length of name + 1)

No 3rd party modules in unrealircd-contrib use this so.. hopefully fine.
---
 configure    | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 configure.ac |  3 +++
 2 files changed, 58 insertions(+)

diff --git a/configure b/configure
index 8d81bf88f..654bb79ee 100755
--- a/configure
+++ b/configure
@@ -5030,6 +5030,61 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
+  # Since we have moved from name[1] to name[], setting this should help bounds checking:
+  ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstrict-flex-arrays=3" >&5
+printf %s "checking whether C compiler accepts -fstrict-flex-arrays=3... " >&6; }
+if test ${ax_cv_check_cflags__Werror___fstrict_flex_arrays_3+y}
+then :
+  printf %s "(cached) " >&6
+else case e in #(
+  e)
+  ax_check_save_flags=$CFLAGS
+  CFLAGS="$CFLAGS -Werror  -fstrict-flex-arrays=3"
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main (void)
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ax_cv_check_cflags__Werror___fstrict_flex_arrays_3=yes
+else case e in #(
+  e) ax_cv_check_cflags__Werror___fstrict_flex_arrays_3=no ;;
+esac
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+  CFLAGS=$ax_check_save_flags ;;
+esac
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags__Werror___fstrict_flex_arrays_3" >&5
+printf "%s\n" "$ax_cv_check_cflags__Werror___fstrict_flex_arrays_3" >&6; }
+if test x"$ax_cv_check_cflags__Werror___fstrict_flex_arrays_3" = xyes
+then :
+  HARDEN_CFLAGS="$HARDEN_CFLAGS -fstrict-flex-arrays=3"
+else case e in #(
+  e) : ;;
+esac
+fi
+
+  ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
   # At the link step, we might want -pie (GCC) or -Wl,-pie (Clang on OS X)
   #
   # The linker checks also compile code, so we need to include -fPIE as well.
diff --git a/configure.ac b/configure.ac
index 06480ccf8..c68958398 100644
--- a/configure.ac
+++ b/configure.ac
@@ -147,6 +147,9 @@ AS_IF([test x"$hardening" != x"no"], [
   # Control Flow Enforcement (ROP hardening) - requires CPU hardware support
   check_cc_flag([-fcf-protection], [HARDEN_CFLAGS="$HARDEN_CFLAGS -fcf-protection"])
 
+  # Since we have moved from name[1] to name[], setting this should help bounds checking:
+  check_cc_flag([-fstrict-flex-arrays=3], [HARDEN_CFLAGS="$HARDEN_CFLAGS -fstrict-flex-arrays=3"])
+
   # At the link step, we might want -pie (GCC) or -Wl,-pie (Clang on OS X)
   #
   # The linker checks also compile code, so we need to include -fPIE as well.