contrib: drop bitcoin-util exception from FORTIFY check
What the developer wrote
Authored by fanquake
contrib: drop bitcoin-util exception from FORTIFY check
It's got memcpy_chk.
What changed, and why it matters
This commit removes a special exception that let the bitcoin-util program skip a security hardening check. The check verifies that important memory-copying functions use a safer fortified version. The exception is no longer needed because bitcoin-util now includes those safer functions. This is a minor hardening improvement, not a fix for an active security flaw.
No urgent action. Reviewers can verify that bitcoin-util release builds now pass the FORTIFY check without the exception and that CI/release pipelines still succeed.
Security signals we found
Removal of a security-check exception
FORTIFY_SOURCE hardening check now applies uniformly
Commit message references fortified function symbol
Evidence from the diff
The patch deletes a hard-coded bypass in contrib/guix/security-check.py that returned True for check_ELF_FORTIFY when the binary was identified as bitcoin-util. The bypass existed because bitcoin-util previously contained no fortified functions. The commit message states ‘It’s got memcpy_chk’, indicating the binary now includes the __memcpy_chk fortified symbol, so the exception is unnecessary. The change tightens the release build’s security checks but does not patch a vulnerability in runtime code.
Changed components
contrib/guix/security-check.pybitcoin-util binary release checksInspect captured patch +0 / −3
diff --git a/contrib/guix/security-check.py b/contrib/guix/security-check.py
index 8e8285fe..be2e0cfb 100755
--- a/contrib/guix/security-check.py
+++ b/contrib/guix/security-check.py
@@ -123,9 +123,6 @@ def check_ELF_CONTROL_FLOW(binary) -> bool:
def check_ELF_FORTIFY(binary) -> bool:
- # bitcoin-util does not currently contain any fortified functions
- if 'Bitcoin Core bitcoin-util utility version ' in binary.strings:
- return True
# bitcoin wrapper does not currently contain any fortified functions
if '--monolithic' in binary.strings:
return True
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.