Hardening security with compiler switches - /GS and /HIGHENTROPYVA

[valdasmisevicius]

We are using NuGet package. But our security audit check complains about opencv_videoio_ffmpegxxx.dll that it is compiled without security hardening flags /GS and /HIGHENTROPYVA
Here is Microsoft recommendations: https://learn.microsoft.com/en-us/cpp/build/reference/gs-buffer-security-check, https://learn.microsoft.com/en-us/cpp/build/reference/highentropyva-support-64-bit-aslr

I see there is ENABLE_BUILD_HARDENING option in opencv CMakeLists.txt (https://github.com/opencv/opencv/blob/d719c6d84a6139e07e81abd3814a3c23756f63eb/CMakeLists.txt#L534)

Is there any way these switches can be enabled for the NuGet build?

[shimat]

Thanks for the report.

We've made the following changes in PR #1843:

1. ENABLE_BUILD_HARDENING=ON added to cmake/opencv_build_options.cmake for Windows builds.
   This enables /GS, /sdl, /guard:cf, and /DYNAMICBASE across all OpenCV modules and OpenCvSharpExtern.dll via OpenCV's existing OpenCVCompilerDefenses.cmake.

2. Explicit hardening flags (/GS, /guard:cf, /DYNAMICBASE, /HIGHENTROPYVA) added to src/CMakeLists.txt for OpenCvSharpExtern.dll.

3. BinSkim verification added as an opt-in CI step (workflow_dispatch) to confirm the flags are in effect after future changes.

Limitation — opencv_videoio_ffmpeg*.dll:
This DLL is a pre-built binary downloaded from the opencv/opencv_3rdparty repository (see opencv/3rdparty/ffmpeg/ffmpeg.cmake). It is not compiled from source in this project, so we cannot apply /DYNAMICBASE or /HIGHENTROPYVA to it. This would need to be addressed upstream in the OpenCV project's FFmpeg binary build pipeline.

[valdasmisevicius]

Great. Thank you.