MbedTLS does not compile on Release (error C2220: the following warning is treated as an error)

[tawmoto]

Summary

I try to build MbedTLS on Release for Windows and it doesn't work.

System information

Mbed TLS version (number or commit id): 4.0.0
Operating system and version: Windows 11
Configuration (if not default, please attach mbedtls_config.h): default
Compiler and options (if you used a pre-built binary, please indicate how you obtained it):

VStudio (I ran `vcvarsall x64` before running CMake)

cmake -DENABLE_TESTING=OFF -DCMAKE_POLICY_DEFAULT_CMP0091=NEW -DCMAKE_INSTALL_PREFIX=<install dir> -G"Ninja" -DCMAKE_STATIC_LINKER_FLAGS=/SUBSYSTEM:CONSOLE,6.01 -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded -DCMAKE_C_FLAGS=/guard:cf ..

ninja install

Expected behavior

Compilation should work.

Actual behavior

[167/242] Building C object tf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_privkey.dir\fuzz_onefile.c.obj
FAILED: tf-psa-crypto/programs/fuzz/CMakeFiles/fuzz_privkey.dir/fuzz_onefile.c.obj
C:\PROGRA~1\MIB055~1\2022\ENTERP~1\VC\Tools\MSVC\1443~1.348\bin\Hostx64\x64\cl.exe  /nologo  -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\framework\tests\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\builtin\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\everest\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\p256-m /guard:cf /O2 /Ob2 /DNDEBUG -MT /W3 /utf-8 /WX /showIncludes /Fotf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_privkey.dir\fuzz_onefile.c.obj /Fdtf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_privkey.dir\ /FS -c C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c
C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c(34): error C2220: the following warning is treated as an error
C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c(34): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
[168/242] Building C object tf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_pubkey.dir\fuzz_onefile.c.obj
FAILED: tf-psa-crypto/programs/fuzz/CMakeFiles/fuzz_pubkey.dir/fuzz_onefile.c.obj
C:\PROGRA~1\MIB055~1\2022\ENTERP~1\VC\Tools\MSVC\1443~1.348\bin\Hostx64\x64\cl.exe  /nologo  -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\framework\tests\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\builtin\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\everest\include -IC:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\drivers\p256-m /guard:cf /O2 /Ob2 /DNDEBUG -MT /W3 /utf-8 /WX /showIncludes /Fotf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_pubkey.dir\fuzz_onefile.c.obj /Fdtf-psa-crypto\programs\fuzz\CMakeFiles\fuzz_pubkey.dir\ /FS -c C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c
C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c(34): error C2220: the following warning is treated as an error
C:\Sources\1\mbedtls-4.0.0\tf-psa-crypto\programs\fuzz\fuzz_onefile.c(34): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
[188/242] Building C object programs\ssl\CMakeFiles\ssl_server2.dir\ssl_server2.c.obj
ninja: build stopped: subcommand failed.

*WARNING: if the actual behaviour suggests memory corruption (like a crash or an error
from a memory checker), then the bug should be assumed to have security
implications (until proven otherwise), and we ask what you report it privately,
see the note at the top of this template.

[minosgalanakis]

Hi and thank you for your report.

Could you please confirm weather the change in this test-pr Mbed-TLS/TF-PSA-Crypto#695 I have just raised fixes your issue?

[tawmoto]

@minosgalanakis yes, your PR fixes it, although I think ifdef _WIN32 (without the second condition) should be enough
thank you

[minosgalanakis]

Thanks for the feedback.

You are right _WIN32 is more than enough, I just added the second check to cast a wider net since I did not know you exact system/enviroment. I will update the pr and pursue reviewers.