This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: GCC 3.0.3 PRs
- From: Paolo Carlini <pcarlini at unitus dot it>
- To: Joe Buck <jbuck at synopsys dot COM>
- Cc: gcc at gcc dot gnu dot org
- Date: Fri, 07 Dec 2001 23:04:03 +0100
- Subject: Re: GCC 3.0.3 PRs
- References: <200112072158.NAA23721@atrus.synopsys.com>
Joe Buck wrote:
> >
> > The only two PRs that remain on my "really wish we could fix these" list
> > are PR3393 (a Fortran regression relative to GCC 3.0) and PR3720
> > (num_get is (partially) broken in V3).
> >
> > Is there any chance of getting those fixed in the next few days?
>
> I think that 3720 should be considered a must-fix. If people use stream
> I/O in security-critical programs, this kind of buffer overflow could lead
> to root exploits in programs that would be perfectly safe with a
> correct iostreams implementation. I don't think it's ethical for us to
> ship with such a bug.
Well, it looks like Benjamin has *already* fixed it for the mainline:
http://gcc.gnu.org/ml/gcc-patches/2001-12/msg00814.html
Apparently, there is a minor nit remaining
(http://gcc.gnu.org/ml/gcc-prs/2001-12/msg00432.html) but otherwise, it suffices to
backport it to gcc-3_0
Cheers,
Paolo.