Switch the default to enabling CFGuard in all individual build-* scripts

build-compiler-rt.sh

@@ -19,8 +19,8 @@ set -e
 SRC_DIR=../lib/builtins
 BUILD_SUFFIX=
 BUILD_BUILTINS=TRUE
-ENABLE_CFGUARD=
-CFGUARD_CFLAGS=
+ENABLE_CFGUARD=1
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     if [ "$1" = "--build-sanitizers" ]; then
@@ -28,6 +28,12 @@ while [ $# -gt 0 ]; do
         BUILD_SUFFIX=-sanitizers
         SANITIZERS=1
         BUILD_BUILTINS=FALSE
+        # Override the default cfguard options here; this unfortunately
+        # also overrides the user option if --enable-cfguard is passed
+        # before --build-sanitizers (although that combination isn't
+        # really intended/supported anyway).
+        CFGUARD_CFLAGS=
+        ENABLE_CFGUARD=
     elif [ "$1" = "--enable-cfguard" ]; then
         CFGUARD_CFLAGS="-mguard=cf"
         ENABLE_CFGUARD=1

build-libcxx.sh

@@ -18,7 +18,7 @@ set -e
 
 BUILD_STATIC=ON
 BUILD_SHARED=ON
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     if [ "$1" = "--disable-shared" ]; then

build-libssp.sh

@@ -16,7 +16,7 @@
 
 set -e
 
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in

build-mingw-w64-libraries.sh

@@ -16,7 +16,7 @@
 
 set -e
 
-USE_CFLAGS="-g -O2"
+USE_CFLAGS="-g -O2 -mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in

build-mingw-w64.sh

@@ -20,7 +20,7 @@ set -e
 : ${DEFAULT_MSVCRT:=ucrt}
 : ${MINGW_W64_VERSION:=ce5a9f624dfc691082dad2ea2af7b1985e3476b5}
 
-CFGUARD_FLAGS=
+CFGUARD_FLAGS="--enable-cfguard"
 
 while [ $# -gt 0 ]; do
     case "$1" in

build-openmp.sh

@@ -16,7 +16,7 @@
 
 set -e
 
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in