This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: US-CERT Vulnerability Note VU#162289
- From: "Andrew Pinski" <pinskia at gmail dot com>
- To: "Robert C. Seacord" <rcs at cert dot org>
- Cc: mark at codesourcery dot com, gcc at gcc dot gnu dot org, "Chad Dougherty" <crd at cert dot org>
- Date: Mon, 7 Apr 2008 10:40:39 -0700
- Subject: Re: US-CERT Vulnerability Note VU#162289
- References: <47FA59B5.5000606@cert.org>
On Mon, Apr 7, 2008 at 10:28 AM, Robert C. Seacord <rcs@cert.org> wrote:
> I believe the vulnerability is that gcc may *silently* discard the overflow
> checks and that this is a recent change in behavior.
No it is not recent, unless you consider 1998 recent :). I don't know
how many times but we have not changed the behavior of GCC with
respect of signed integer overflow being undefined. Since the loop
optimizers have said this before, we just added an extra pass which
depends on it more. I guess you did not read the GCC mailing list
before posting this Vulnerability because we already discussed this
many many times before around the time GCC 4.2.0 came out.
Also try -Wstrict-overflow=5 in GCC 4.2.3 and in GCC 4.3.0, we already
warn about most if not all cases already.
Thanks,
Andrew Pinski