What the developer wrote
Authored by Jon Griffiths
cmake: add missing defines
What changed, and why it matters
This commit fixes the CMake build system so it correctly detects several platform features and headers that the library's C code relies on. Before this fix, the CMake build could silently produce a misconfigured library that uses less secure fallback code paths (for example, missing secure memory-zeroing functions or unaligned-access handling). The commit does not change the core cryptographic code itself; it only changes how the build system discovers what the current platform supports.
Treat as a build-hardening fix. Users building with CMake should update and regenerate config.h. Review downstream builds to confirm that HAVE_EXPLICIT_BZERO, HAVE_EXPLICIT_MEMSET, HAVE_MEMSET_S, HAVE_UNALIGNED_ACCESS, and WORDS_BIGENDIAN are now correctly populated for their platform. No immediate runtime patch is required beyond rebuilding.
Security signals we found
Missing feature probes could cause secure-memory helpers (explicit_bzero/explicit_memset/memset_s) to be disabled at compile time
Missing unaligned-access detection could lead to incorrect behavior on strict-alignment platforms
Missing endianness detection could affect byte-order-dependent cryptographic operations
Build-system-only change; no direct vulnerability in the diff
Evidence from the diff
The patch updates _cmake/config.h.in and _cmake/utils.cmake. It adds CMake checks for headers and functions that were previously only detected by autotools: asm/page.h, byteswap.h, mbedtls/sha256.h, memset_s, and unistd.h. It also replaces a hand-rolled WORDS_BIGENDIAN detection block with a CMake-driven check based on CMAKE_C_BYTE_ORDER. The typo in the byteswap.h comment is corrected. A FIXME note is added for AC_APPLE_UNIVERSAL_BUILD. These are build-configuration plumbing changes; no runtime logic is altered.
Changed components
_cmake/config.h.in_cmake/utils.cmakeCMake build configuration for libwally-coreInspect captured patch +16 / −12
diff --git a/_cmake/config.h.in b/_cmake/config.h.in
index 692b63e..fd045ba 100644
--- a/_cmake/config.h.in
+++ b/_cmake/config.h.in
@@ -7,8 +7,7 @@
/* Define to 1 if you have the <asm/page.h> header file. */
#cmakedefine HAVE_ASM_PAGE_H @HAVE_ASM_PAGE_H@
-
-/* Define to 1 if you have the <byteswap.h,> header file. */
+/* Define to 1 if you have the <byteswap.h> header file. */
#cmakedefine HAVE_BYTESWAP_H @HAVE_BYTESWAP_H@
/* Define to 1 if you have the `explicit_bzero' function. */
@@ -41,6 +40,9 @@
/* Define if we have unaligned access */
#cmakedefine HAVE_UNALIGNED_ACCESS @HAVE_UNALIGNED_ACCESS@
+/* Define to 1 if you have the <unistd.h> header file. */
+#cmakedefine HAVE_UNISTD_H @HAVE_UNISTD_H@
+
/* Name of package */
#cmakedefine PACKAGE @PACKAGE@
@@ -65,17 +67,7 @@
/* Version number of package */
#cmakedefine VERSION @VERSION@
-/* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
- significant byte first (like Motorola and SPARC, unlike Intel). */
-#if defined AC_APPLE_UNIVERSAL_BUILD
-# if defined __BIG_ENDIAN__
-# define WORDS_BIGENDIAN 1
-# endif
-#else
-# ifndef WORDS_BIGENDIAN
#cmakedefine WORDS_BIGENDIAN @WORDS_BIGENDIAN@
-# endif
-#endif
#if defined (_WIN32) && !defined(_SSIZE_T_DECLARED) && !defined(_ssize_t) && !defined(ssize_t)
#if defined(_WIN64)
diff --git a/_cmake/utils.cmake b/_cmake/utils.cmake
index 490e964..7532d70 100644
--- a/_cmake/utils.cmake
+++ b/_cmake/utils.cmake
@@ -4,13 +4,18 @@ include(CheckFunctionExists)
include(CheckCSourceRuns)
function(generate_config_file)
+ # FIXME: AC_APPLE_UNIVERSAL_BUILD
+ check_include_file("asm/page.h" HAVE_ASM_PAGE_H)
+ check_include_file("byteswap.h" HAVE_BYTESWAP_H)
check_function_exists("explicit_bzero" HAVE_EXPLICIT_BZERO)
check_function_exists("explicit_memset" HAVE_EXPLICIT_MEMSET)
check_c_source_compiles(
"int main(void) {int a = 42; int *pnt = &a; __asm__ __volatile__ (\"\" : : \"r\"(pnt) : \"memory\");}"
HAVE_INLINE_ASM
)
+ check_include_file("mbedtls/sha256.h" HAVE_MBEDTLS_SHA256_H)
check_include_file("mbedtls/sha512.h" HAVE_MBEDTLS_SHA512_H)
+ check_function_exists("memset_s" HAVE_MEMSET_S)
check_function_exists("mmap" HAVE_MMAP)
check_function_exists("posix_memalign" HAVE_POSIX_MEMALIGN)
check_include_file("sys/mman.h" HAVE_SYS_MMAN_H)
@@ -21,6 +26,7 @@ function(generate_config_file)
"int main(void){static int a[2];return *((int*)(((char*)a)+1)) != 0;}" HAVE_UNALIGNED_ACCESS
)
endif()
+ check_include_file("unistd.h" HAVE_UNISTD_H)
set(PACKAGE \"${CMAKE_PROJECT_NAME}\")
set(PACKAGE_BUGREPORT \"\")
set(PACKAGE_NAME \"${CMAKE_PROJECT_NAME}\")
@@ -30,5 +36,11 @@ function(generate_config_file)
set(PACKAGE_VERSION \"${CMAKE_PROJECT_VERSION}\")
set(VERSION \"${CMAKE_PROJECT_VERSION}\")
+ if(CMAKE_C_BYTE_ORDER STREQUAL "BIG_ENDIAN")
+ set(WORDS_BIGENDIAN TRUE)
+ else()
+ set(WORDS_BIGENDIAN FALSE)
+ endif()
+
configure_file(cmake/config.h.in config.h)
endfunction()
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.