fix(build): Control Flow Guard and SDL checks on every library

/guard:cf only guards code compiled with it, so the NVAPI function-pointer
calls in hw/ were unchecked. A gao_hardening interface now applies
/guard:cf /sdl to core, hw and gao (clean build). Also from the review:
presets require CMake 4.2 (the VS 2026 generator), test presets fail when no
test is found, read_lines reports a read error mid-file, and the strike test
asserts the exact fail-closed value.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Rovey

CMakeLists.txt

@@ -17,6 +17,12 @@ if(GAO_ASAN)
   add_link_options(/INCREMENTAL:NO)
 endif()
 
+# Exploit mitigations for code that runs elevated: Control Flow Guard (every
+# indirect call, including the NVAPI function pointers in hw/), SDL checks.
+# The linker half (/GUARD:CF /CETCOMPAT) is on the executable.
+add_library(gao_hardening INTERFACE)
+target_compile_options(gao_hardening INTERFACE /guard:cf /sdl)
+
 # Warning set for our own code (cpp-best-practices MSVC list). Third-party
 # headers are SYSTEM includes and stay quiet through /external:W0.
 add_library(gao_warnings INTERFACE)
@@ -55,7 +61,7 @@ add_library(core STATIC
 )
 target_include_directories(core PUBLIC src)
 target_include_directories(core SYSTEM PRIVATE third_party)
-target_link_libraries(core PRIVATE gao_warnings)
+target_link_libraries(core PRIVATE gao_warnings gao_hardening)
 
 # The only code allowed to touch hardware.
 add_library(hw STATIC
@@ -67,20 +73,18 @@ add_library(hw STATIC
   src/hw/boot_task.hpp src/hw/boot_task.cpp
 )
 target_include_directories(hw PUBLIC src)
-target_link_libraries(hw PUBLIC core d3d11 dxgi d3dcompiler shell32 ole32 PRIVATE gao_warnings)
+target_link_libraries(hw PUBLIC core d3d11 dxgi d3dcompiler shell32 ole32 PRIVATE gao_warnings gao_hardening)
 
 add_executable(gao src/app/main.cpp src/app/gao.manifest)
-target_link_libraries(gao PRIVATE core hw gao_warnings)
+target_link_libraries(gao PRIVATE core hw gao_warnings gao_hardening)
 # d3dcompiler_47.dll, d3d11.dll and dxgi.dll are not KnownDLLs: delay-load
 # them so they resolve after SetDefaultDllDirectories(SYSTEM32) in main(),
 # never from the exe's folder.
 target_link_libraries(gao PRIVATE delayimp)
 target_link_options(gao PRIVATE /DELAYLOAD:d3dcompiler_47.dll /DELAYLOAD:d3d11.dll /DELAYLOAD:dxgi.dll
                    /DEPENDENTLOADFLAG:0x800)
-# Exploit mitigations for an exe that runs elevated: Control Flow Guard, CET
-# shadow stack compatibility, SDL checks. (/DYNAMICBASE and /HIGHENTROPYVA are
-# already the x64 defaults.)
-target_compile_options(gao PRIVATE /guard:cf /sdl)
+# Linker half of the mitigations: Control Flow Guard tables, CET shadow stack
+# compatibility. (/DYNAMICBASE and /HIGHENTROPYVA are already x64 defaults.)
 target_link_options(gao PRIVATE /GUARD:CF /CETCOMPAT)
 
 enable_testing()

CMakePresets.json

@@ -1,6 +1,6 @@
 {
   "version": 6,
-  "cmakeMinimumRequired": { "major": 3, "minor": 28, "patch": 0 },
+  "cmakeMinimumRequired": { "major": 4, "minor": 2, "patch": 0 },
   "configurePresets": [
     {
       "name": "default",
@@ -23,9 +23,9 @@
     { "name": "asan", "configurePreset": "asan", "configuration": "RelWithDebInfo" }
   ],
   "testPresets": [
-    { "name": "debug", "configurePreset": "default", "configuration": "Debug", "output": { "outputOnFailure": true } },
-    { "name": "release", "configurePreset": "default", "configuration": "Release", "output": { "outputOnFailure": true } },
-    { "name": "asan", "configurePreset": "asan", "configuration": "RelWithDebInfo", "output": { "outputOnFailure": true } }
+    { "name": "debug", "configurePreset": "default", "configuration": "Debug", "output": { "outputOnFailure": true }, "execution": { "noTestsAction": "error" } },
+    { "name": "release", "configurePreset": "default", "configuration": "Release", "output": { "outputOnFailure": true }, "execution": { "noTestsAction": "error" } },
+    { "name": "asan", "configurePreset": "asan", "configuration": "RelWithDebInfo", "output": { "outputOnFailure": true }, "execution": { "noTestsAction": "error" } }
   ],
   "workflowPresets": [
     {

README.md

@@ -19,7 +19,7 @@
 
 ## Quick start
 
-Requires an x64 Windows machine with Visual Studio 2026 (C++ and CMake workload) and CMake >= 3.28. From a Developer PowerShell, in the repo root:
+Requires an x64 Windows machine with Visual Studio 2026 (C++ and CMake workload), whose bundled CMake (4.2 or newer) knows the VS 2026 generator. From a Developer PowerShell, in the repo root:
 
 ```powershell
 cmake --workflow --preset ci    # configure, build Release, run the tests
@@ -105,7 +105,7 @@ cmake --build --preset asan
 ctest --preset asan               # needs the MSVC bin\Hostx64\x64 folder on PATH
 ```
 
-Our code builds at `/W4 /permissive-` with warnings as errors; `third_party/` is a system include. `gao.exe` is linked with Control Flow Guard and CET compatibility and carries an application manifest.
+Our code builds at `/W4 /permissive-` with warnings as errors; `third_party/` is a system include. All of it is compiled with Control Flow Guard and SDL checks; `gao.exe` is linked CET-compatible and carries an application manifest.
 
 `core_tests` is the only test binary. It covers `src/core/` -- presets, config round-trip, and the `GpuControl` seam that lets tests drive fake hardware through lambdas -- and needs no GPU, which is why CI runs it on a GitHub-hosted `windows-2025` runner, once normally and once under AddressSanitizer. `src/hw/` (NVML, NVAPI) is verified manually on real hardware instead, through [`docs/hardware-checks.md`](docs/hardware-checks.md); CI still builds the full `gao.exe` so a link error in the hardware layer is caught there rather than on a developer's machine.
 

src/hw/app_files.cpp

@@ -100,6 +100,7 @@ std::optional<std::vector<std::string>> read_lines(const std::filesystem::path&
     std::ifstream in(p, std::ios::binary);
     if (!in) return std::nullopt;
     for (std::string line; std::getline(in, line);) lines.push_back(line);
+    if (in.bad()) return std::nullopt;   // a truncated journal could drop a ceiling
     return lines;
 }
 

tests/test_config.cpp

@@ -1,5 +1,6 @@
 #include "doctest/doctest.h"
 #include "core/config.hpp"
+#include "core/boot.hpp"
 
 using namespace gao;
 
@@ -80,7 +81,7 @@ TEST_CASE("a strike count that is not a sane integer fails closed") {
     for (const char* bad : {R"({"boot_strikes":3.0})", R"({"boot_strikes":-1})", R"({"boot_strikes":4294967296})",
                             R"({"boot_strikes":"x"})", R"({"boot_strikes":1001})", R"({"boot_strikes":null})"}) {
         CAPTURE(bad);
-        CHECK(from_json(bad).boot_strikes >= 3);
+        CHECK(from_json(bad).boot_strikes == kMaxBootStrikes);
     }
     CHECK(from_json(R"({"boot_strikes":0})").boot_strikes == 0);
     CHECK(from_json(R"({"boot_strikes":2})").boot_strikes == 2);