From 04764b80310594bb2dcdd6f1665d8210307c499b Mon Sep 17 00:00:00 2001
From: dongresource <dongresource@protonmail.com>
Date: Sun, 4 May 2025 22:23:12 +0200
Subject: [PATCH] Build with -fcf-protection if building for x86_64

---
 Makefile | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Makefile b/Makefile
index b6541dc4..acb0a2bc 100644
--- a/Makefile
+++ b/Makefile
@@ -22,6 +22,17 @@ WIN_CXXFLAGS=$(WIN_CFLAGS) -std=c++17 -DPROTOCOL_VERSION=$(PROTOCOL_VERSION) -DG
 WIN_LDFLAGS=-static -lws2_32 -lwsock32 -lsqlite3
 WIN_SERVER=bin/winfusion.exe
 
+# Compile with Intel Control-flow Enforcement, but only for x86_64
+CFLAGS-x86_64=-fcf-protection=full
+LDFLAGS-x86_64=-fcf-protection=full
+WIN_CFLAGS-x86_64=-fcf-protection=full
+WIN_LDFLAGS-x86_64=-fcf-protection=full
+
+CFLAGS+=$(CFLAGS-$(shell uname -m))
+LDFLAGS+=$(CFLAGS-$(shell uname -m))
+WIN_CFLAGS+=$(CFLAGS-$(shell uname -m))
+WIN_LDFLAGS+=$(CFLAGS-$(shell uname -m))
+
 # C code; currently exclusively from vendored libraries
 CSRC=\
 	vendor/bcrypt/bcrypt.c\