AD2026: EnableMicrosoftCompilerSdlSwitch¶

Summary¶

Description¶

The /sdl (Enable Additional Security Checks) flag enables a superset of the security checks provided by /GS and overrides /GS-. When /sdl is specified, the compiler enables:

• Strict pointer-type checks
• Data integrity checks for run-time function buffers
• Additional security-focused warnings as errors

The /sdl flag was introduced in Visual Studio 2012.

How It Works¶

The rule examines PDB compilation flags for the presence of /sdl. This flag enables:

1. All /GS checks
2. Additional compile-time warnings treated as errors
3. Extra runtime checks for pointer operations
4. Strict parameter validation

Why This Matters¶

The /sdl flag enables a curated set of security checks developed from Microsoft's internal Security Development Lifecycle (SDL) program—the same practices that protect Windows, Office, and Azure. It represents Microsoft's security expertise encoded as compiler checks.

SDL Background¶

Microsoft's Security Development Lifecycle was developed after major security incidents in the early 2000s:

The /sdl flag makes SDL security checks accessible to all developers.

What /sdl Enables¶

Runtime Checks:

Compile-time Warnings-as-Errors:

Beyond Standard /GS¶

/sdl adds protections beyond /GS:

class Example {
    int* ptr;  // Pointer member
public:
    void work() {
        // With /sdl: ptr is zeroed on destruction
        // Without: ptr value remains in freed memory
    }
};

This prevents use-after-free attacks that rely on stale pointer values.

Enterprise and Compliance Value¶

/sdl provides demonstrable due diligence:

Performance Considerations¶

/sdl checks add minimal overhead:

Migration Path¶

Enabling /sdl may produce new errors in existing code:

1. First: Enable in warning mode (/sdl- with /W4)
2. Second: Fix identified issues
3. Third: Enable /sdl fully
4. Maintain: Keep enabled for all new code

Resolution¶

Enable /sdl¶

Compiler flag:

cl.exe /sdl ...

Project Properties¶

1. Open Project Properties
2. Navigate to C/C++ → General
3. Set "SDL checks" to "Yes (/sdl)"

CMake¶

if(MSVC)
    add_compile_options(/sdl)
endif()

When to Suppress¶

This rule may be suppressed for:

• Legacy code: Old code that generates many /sdl warnings
• Third-party code: When you can't modify the source
• Older compilers: VS 2010 and earlier don't support /sdl

Caveats¶

• Requires Visual Studio 2012 or later
• May generate errors in code that compiled previously
• Some warnings may need code changes to resolve

What /sdl Enables¶

Compile-Time Checks¶

Runtime Checks¶

• Strict GS buffer overrun detection
• Pointer validation before use
• Parameter validation for CRT functions

Comparing /GS vs /sdl¶

Related Rules¶

• AD2007: EnableCriticalCompilerWarnings
• AD2011: EnableStackProtection

References¶

• /sdl (Enable Additional Security Checks)
• Security Development Lifecycle