This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: GCC 3.0.3 PRs
- From: Joe Buck <jbuck at synopsys dot COM>
- To: mark at codesourcery dot com (Mark Mitchell)
- Cc: gcc at gcc dot gnu dot org, toon at moene dot indiv dot nluug dot nl, bkoz at redhat dot com
- Date: Fri, 7 Dec 2001 13:58:38 -0800 (PST)
- Subject: Re: GCC 3.0.3 PRs
>
> The only two PRs that remain on my "really wish we could fix these" list
> are PR3393 (a Fortran regression relative to GCC 3.0) and PR3720
> (num_get is (partially) broken in V3).
>
> Is there any chance of getting those fixed in the next few days?
I think that 3720 should be considered a must-fix. If people use stream
I/O in security-critical programs, this kind of buffer overflow could lead
to root exploits in programs that would be perfectly safe with a
correct iostreams implementation. I don't think it's ethical for us to
ship with such a bug.
Also, it shouldn't be hard to fix it once agreement is reached on how.
All that's needed is an upper bound on buffer size.