#1437 Compile with Control Flow Guard

[moshe]

Please consider compiling Windows Scintilla with Control Flow Guard, to improve the security of other Windows projects that rely on Scintilla, like Notepad++. Attached is a diff based on Scintilla 5.2.2 that would enable compiling with Control Flow Guard.

For more information about Control Flow Guard, see:
https://docs.microsoft.com/en-us/cpp/build/reference/guard-enable-control-flow-guard?view=msvc-170

For the Notepad++ ticket, see https://github.com/notepad-plus-plus/notepad-plus-plus/issues/8108

[Neil Hodgson]

Have you measured the performance impact on Scintilla? It uses indirect calls widely including between Scintilla and Lexilla where the checks can't be optimized away.

[moshe]

Thanks for the quick response Neil. I have not done any performance testing. Do you already have a set of files and programs that you use for benchmarking?

[Neil Hodgson]

This was rejected for the Notepad++ project due to performance concerns.

Downstream projects will have different threat models and different mitigation strategies. Most editor applications allow easily performing unbounded actions like running user scripts or compiling and running arbitrary code. Hardening the compiled Scintilla code will make little difference to the exploitability of these applications and comes with a performance and energy cost.

Some applications may desire more hardening. For example, a database maintenance tool that allows viewing stored procedures or database schemas but does not allow running user defined commands may see value in this. Such projects can choose to enable Control Flow Guard by changing an option in Visual Studio for each DLL/EXE.

I'm closing this issue as "Won't_Implement" but it could be revisited in the future.