diff --git a/docs/PATCHES.md b/docs/PATCHES.md index 1fdc8152..ab3d7ced 100644 --- a/docs/PATCHES.md +++ b/docs/PATCHES.md @@ -137,7 +137,9 @@ |**Enable -fwrapv in Clang for non-UBSan builds**
Thu, 22 Dec 2016 07:15:34 -0500
File: [Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch](/build/patches/Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch)
Author: Daniel
Context:
License: GPL-3.0-only |Using -fwrapv (notably only when not using signed integer overflow checking -
since it will override it and result in not performing checks) is just common
sense since it eliminates the chance of security vulnerabilities being
introduced by optimizations based on signed overflow being undefined.
That has happened before, and those optimizations don't even add up to a 0.1%
performance increase for this kind of software. It's not worth having.
The Linux kernel passes -fwrapv and also -fno-strict-aliasing to disable those
dangerous optimizations (since there is so much incorrect code they can break).
In fact, it is easy to point to dozens of known examples of invalid code that
could potentially be broken by those optimizations.
It is not acceptable for projects to be using optimizations that are known to
be broken with a bunch of code in their tree.
They put barely any effort into even fixing the known cases.
Chromium has blacklists for UBSan for 'false positives' (none of which are
actually false positives, but rather "undefined, but not a bug beyond
potentially being broken by optimizations or even code generation without
them") and also for components too full of these bugs for them to currently
want to bother with it. That includes a bunch of signed overflow issues
(there is sadly no detection for aliasing violations, which are fairly common,
but not that common).
Ideally, -fwrapv could be always passed, but unfortunately the way it is
implemented has silly interactions with other switches.
The reason it would still make sense to pass it is because due to their UBSan
blacklists, they get far from full coverage with it, so -fwrapv would still
be better than nothing where it's not being used.
Since -fwrapv makes signed integer overflow well-defined, Clang will disable
the UBSan checks for signed integer overflow, including in the
production-oriented trapping mode used for hardening.
Excerpt from https://github.com/bromite/bromite/issues/226| |**Enable Android Dynamic Performance Framework**
Wed, 23 Aug 2023 13:49:19 +0000
File: [Enable-Android-Dynamic-Performance-Framework.patch](/build/patches/Enable-Android-Dynamic-Performance-Framework.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || |**Enable Certificate Transparency**
Fri, 10 Jun 2022 14:20:02 +0200
File: [Enable-Certificate-Transparency.patch](/build/patches/Enable-Certificate-Transparency.patch)
Author: csagan5
Context:
License: GPL-3.0-only |Reporting/auditing functionalities are disabled; a flag is exposed.
Add guard to make sure that certificate transparency stays enabled
by default.| +|**Enable Do-Not-Track by default**
Wed, 29 May 2024 13:49:01 +0000
File: [Enable-Do-Not-Track-by-default.patch](/build/patches/Enable-Do-Not-Track-by-default.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || |**Enable Document Open Inheritance Removal**
Tue, 28 Mar 2023 15:43:18 +0000
File: [Enable-Document-Open-Inheritance-Removal.patch](/build/patches/Enable-Document-Open-Inheritance-Removal.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || +|**Enable Global Privacy Control**
Wed, 29 May 2024 13:43:50 +0000
File: [Enable-Global-Privacy-Control.patch](/build/patches/Enable-Global-Privacy-Control.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || |**Enable HEVC by default**
Tue, 27 Sep 2022 23:39:54 +0200
File: [Enable-HEVC-by-default.patch](/build/patches/Enable-HEVC-by-default.patch)
Author: csagan5
Context:
License: GPL-3.0-only |Add a guard to avoid setting to be disabled upstream.| |**Enable ImprovedBookmarks by default**
Tue, 12 Sep 2023 12:39:23 +0000
File: [Enable-ImprovedBookmarks-by-default.patch](/build/patches/Enable-ImprovedBookmarks-by-default.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || |**Enable PermuteTLSExtensions by default**
Fri, 2 Dec 2022 01:18:14 +0100
File: [Enable-PermuteTLSExtensions-by-default.patch](/build/patches/Enable-PermuteTLSExtensions-by-default.patch)
Author: csagan5
Context:
License: GPL-3.0-only ||