Add fuzz test that finds previously missed coverage

hardening-check tests both CET (x86-only) and branch protection
(arm64-only). Pass the ignore flag for whichever doesn't apply to the
build arch so the test passes on all supported architectures.

CMakeLists.txt

@@ -51,12 +51,16 @@ if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
   add_compile_options("-Wno-maybe-uninitialized")
 endif()
 
-set(full_relro_flags "-pie;LINKER:-z,relro,-z,now,-z,noexecstack")
+set(relro_flags "LINKER:-z,relro,-z,now,-z,noexecstack")
+set(full_relro_flags "-pie;${relro_flags}")
 cmake_push_check_state()
 list(APPEND CMAKE_REQUIRED_LINK_OPTIONS ${full_relro_flags})
 check_cxx_source_compiles("int main(){}" HAS_FULL_RELRO FAIL_REGEX "warning:")
 if(HAS_FULL_RELRO)
-  add_link_options(${full_relro_flags})
+  # -pie only applies to executables; passing it when linking a shared library
+  # makes the driver pull in Scrt1.o, which requires main.
+  add_link_options("$<$<STREQUAL:$<TARGET_PROPERTY:TYPE>,EXECUTABLE>:-pie>"
+                   ${relro_flags})
 endif()
 cmake_pop_check_state()
 
@@ -202,9 +206,18 @@ endif()
 if(NOT CMAKE_CROSSCOMPILING)
   find_program(HARDENING_CHECK hardening-check)
   if(HARDENING_CHECK)
-    add_test(NAME hardening_check
+    # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
-             COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}>
+    # is arm64-only, so ignore whichever doesn't apply.
-                     --nofortify --nostackprotector)
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+                                                  STREQUAL arm64)
+      set(hardening_check_arch_flags --nocfprotection)
+    else()
+      set(hardening_check_arch_flags --nobranchprotection)
+    endif()
+    add_test(
+      NAME hardening_check
+      COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify
+              --nostackprotector ${hardening_check_arch_flags})
   endif()
 endif()