Visual C++ runtime type is not specified in Makefile.nmake, resulting in the error-prone defaults used

[gh-andre]

If the Visual C++ compiler is invoked without explicit /MD (release) or /MDd (debug), it will default to /MT and /MTd, respectively. This, in turn, tells the compiler to use a static runtime (CRT), which will be duplicated in all DLLs used by the application that includes isa_l-crpyto. This configuration is typically selected for very specific projects that need to ship without any additional DLLs and is rarely used. What makes this configuration dangerous is that the linker will issue a warning like this:

LINK : warning LNK4098: defaultlib 'MSVCRT' conflicts with use of other libs; use /NODEFAULTLIB:library

, which can be easily missed in a large project. However, the resulting code will crash whenever memory is allocated in one module and deallocated in another module. There are other problems in this configuration because each module contains its own version of the CRT.

The CRT options need to be explicitly specified to avoid this, like so (the /MDd and /MD options):

--- a/Makefile.nmake	2024-05-28 11:28:37.000000000 -0400
+++ b/Makefile.nmake	2024-09-22 14:21:44.082055800 -0400
@@ -267,8 +267,8 @@
 INCLUDES  = -I./ -Isha1_mb/ -Isha256_mb/ -Isha512_mb/ -Imd5_mb/ -Imh_sha1/ -Imh_sha1_murmur3_x64_128/ -Imh_sha256/ -Irolling_hash/ -Ism3_mb/ -Iaes/ -Iinclude/ -Iintel-ipsec-mb/lib
 # Modern asm feature level, consider upgrading nasm before decreasing feature_level
 FEAT_FLAGS = -DAS_FEATURE_LEVEL=10
-CFLAGS_REL = -O2 -DNDEBUG /Z7 /Gy /ZH:SHA_256 /guard:cf
-CFLAGS_DBG = -Od -DDEBUG /Z7
+CFLAGS_REL = -O2 -DNDEBUG /Z7 /MD /Gy /ZH:SHA_256 /guard:cf
+CFLAGS_DBG = -Od -DDEBUG /Z7 /MDd
 
 !if "$(CONFIG)" == "DEBUG"
 CFLAGS=$(CFLAGS_DBG)