build: add -Wa,-mbranches-within-32B-boundaries compiler flag

CMakeLists.txt

@@ -373,6 +373,13 @@ if (NOT S2N_EXECINFO_AVAILABLE)
 endif()
 feature_probe_result(S2N_STACKTRACE ${S2N_STACKTRACE})
 
+if (S2N_BRANCH_ALIGN AND NOT S2N_FUZZ_TEST)
+    set(BRANCH_ALIGN_FLAG "-Wa,-mbranches-within-32B-boundaries")
+    target_compile_options(${PROJECT_NAME} PRIVATE ${BRANCH_ALIGN_FLAG})
+else()
+    set(BRANCH_ALIGN_FLAG "")
+endif()
+
 if (S2N_INTERN_LIBCRYPTO)
 
     # Check if the AWS::crypto target has beeen added and handle it

bindings/rust/extended/s2n-tls-sys/build.rs

@@ -185,7 +185,8 @@ fn builder(libcrypto: &Libcrypto) -> cc::Build {
         .flag_if_supported("-z now")
         .flag_if_supported("-z noexecstack")
         // we use some deprecated libcrypto features so don't warn here
-        .flag_if_supported("-Wno-deprecated-declarations");
+        .flag_if_supported("-Wno-deprecated-declarations")
+        .flag_if_supported("-Wa,-mbranches-within-32B-boundaries");
 
     build
 }

tests/features/S2N_BRANCH_ALIGN.c

@@ -0,0 +1,18 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License").
+ * You may not use this file except in compliance with the License.
+ * A copy of the License is located at
+ *
+ *  http://aws.amazon.com/apache2.0
+ *
+ * or in the "license" file accompanying this file. This file is distributed
+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+ int main() {
+     return 0;
+ }

tests/features/S2N_BRANCH_ALIGN.flags

@@ -0,0 +1 @@
+-Wa,-mbranches-within-32B-boundaries