This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: US-CERT Vulnerability Note VU#162289
- From: Robert Dewar <dewar at adacore dot com>
- To: Paul Koning <Paul_Koning at dell dot com>, dewar at adacore dot com, mark at codesourcery dot com, rcs at cert dot org, neil at daikokuya dot co dot uk, davem at davemloft dot net, Joe dot Buck at synopsys dot COM, crd at cert dot org, gcc at gcc dot gnu dot org, cert at cert dot org
- Date: Sat, 26 Apr 2008 12:12:13 -0400
- Subject: Re: US-CERT Vulnerability Note VU#162289
- References: <20080423.054228.210900224.davem@davemloft.net> <480F3470.2050909@cert.org> <20080423152444.GC11922@synopsys.com> <20080423.153726.58194927.davem@davemloft.net> <20080424150632.GA19131@daikokuya.co.uk> <20080424150906.GB19131@daikokuya.co.uk> <4810A998.5080702@cert.org> <4810B10B.8010806@codesourcery.com> <4811F4E8.5080309@adacore.com> <18449.64661.900618.390597@gargle.gargle.HOWL> <20080425161110.GA24610@caradoc.them.org>
Daniel Jacobowitz wrote:
On Fri, Apr 25, 2008 at 11:45:25AM -0400, Paul Koning wrote:
Robert> To me, the whole notion of this vulnerability node is flawed
Robert> in that respect. You can write a lengthy and useful book on
Robert> pitfalls in C that must be avoided, but I see no reason to
Robert> turn such a book into a cert advisory, let alone pick out a
Robert> single arbitrary example on a particular compiler!
I think that comment is absolutely correct.
The R in CERT is "Response" (at least it used to be; I can't find an
expansion on their web site...). They're responding to a problem that
was reported to them, and alerting others to the problem. We can
argue about the details, but not about the need to respond.
But surely they are not in the general business of responding to
comments of the form:
"I have an incorrect C program that is undefined by the standard,
and it did not behave as I expected it to!"
If so, I can imagine lots more comments!
They can respond, but the response should be "This program
is incorrect C, and its semantics are not defined by C, security
critical programs should always avoid use of such constructs."
End of (canned) response
Somehow implying that the commpiler is at fault for not providing
expected semantics for programs where the programmer has no right
to expect anything is technically unsound and confusing.
Yes, it is often the case that incorrect programs will do what
is expected (whatever that may be) one day, and not the next day.
That is what undefined is about!