This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: GCC 3.0.3 PRs
- From: Mark Mitchell <mark at codesourcery dot com>
- To: Joe Buck <jbuck at synopsys dot COM>
- Cc: "gcc at gcc dot gnu dot org" <gcc at gcc dot gnu dot org>, "toon at moene dot indiv dot nluug dot nl" <toon at moene dot indiv dot nluug dot nl>, "bkoz at redhat dot com" <bkoz at redhat dot com>
- Date: Fri, 07 Dec 2001 14:17:57 -0800
- Subject: Re: GCC 3.0.3 PRs
--On Friday, December 07, 2001 01:58:38 PM -0800 Joe Buck
<jbuck@synopsys.COM> wrote:
>
>> Is there any chance of getting those fixed in the next few days?
>
> I think that 3720 should be considered a must-fix. If people use stream
> I/O in security-critical programs, this kind of buffer overflow could lead
> to root exploits in programs that would be perfectly safe with a
> correct iostreams implementation. I don't think it's ethical for us to
> ship with such a bug.
Well, OK. Of course, any code-gen bug could lead to the same kinds
of problems. Still, I see your point.
> Also, it shouldn't be hard to fix it once agreement is reached on how.
> All that's needed is an upper bound on buffer size.
Benjamin, can you work on this ASAP? Otherwise, I'll threatent to
engineer my own quick fix for the branch to make Joe happy, but you'll
probably not like how I do it. :-)
Thanks,
--
Mark Mitchell mark@codesourcery.com
CodeSourcery, LLC http://www.codesourcery.com