Re: GCC 3.0.3 PRs

[Joe Buck <jbuck at synopsys dot COM>]

I wrote:
> > I think that 3720 should be considered a must-fix.  If people use stream
> > I/O in security-critical programs, this kind of buffer overflow could lead
> > to root exploits in programs that would be perfectly safe with a
> > correct iostreams implementation.  I don't think it's ethical for us to
> > ship with such a bug.

Paolo writes:
> Well, it looks like Benjamin has *already* fixed it for the mainline:
> 
>     http://gcc.gnu.org/ml/gcc-patches/2001-12/msg00814.html
> 
> Apparently, there is a minor nit remaining
> (http://gcc.gnu.org/ml/gcc-prs/2001-12/msg00432.html) but otherwise, it suffices to
> backport it to gcc-3_0

I would call this objection more than a minor nit.  First, the proposed
patch is very slow for base != 10, second, Philip reports that it is
broken for some values (his example is reading 017777777777 into a long on
x86).

I don't think that backporting this patch would be acceptable until
these two issues are addressed.