This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug other/77409] CVE-2016-4973 Targets using libssp for SSP are missing -D_FORTIFY_SOURCE functionality
- From: "yselkowi at redhat dot com" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Tue, 30 Aug 2016 01:59:32 +0000
- Subject: [Bug other/77409] CVE-2016-4973 Targets using libssp for SSP are missing -D_FORTIFY_SOURCE functionality
- Auto-submitted: auto-generated
- References: <bug-77409-4@http.gcc.gnu.org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77409
Yaakov Selkowitz <yselkowi at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |UNCONFIRMED
Resolution|INVALID |---
--- Comment #9 from Yaakov Selkowitz <yselkowi at redhat dot com> ---
(In reply to Andrew Pinski from comment #7)
> This is a bug in newlib and MinGW (Cygwin and RTEMS uses newlib) rather than
> in GCC for not supporting -D_FORTIFY_SOURCE . ssp should not be the one
> supplying this support (it just happens to does not mean it does for all
> things).
The entire point of libssp is to provide this support on systems whose libc
does not include it, so that both -D_FORTIFY_SOURCE and -fstack-protector*
functionality would be available cross-platform.
Also note that you can't say "just add it to libc" for either MinGW or
commercial *NIXs.