Re: US-CERT Vulnerability Note VU#162289

[Mark Mitchell <mark at codesourcery dot com>]

Mark Mitchell wrote:
> Mark Mitchell wrote:
>
> > I've been told that Intel's ICC compiler also does this optimization:
>
> Apparently, IAR's Atmel AVR compiler does this optimization as well. 
> That CPU has 16-bit addresses, so the tester changed the test case to 
> use "1 << 14" instead of "1 << 30".

I've also been told that Microsoft Visual C++ 2005 compiler does this 
optimization.

Chad, Robert, are you going to update the CERT notice to reflect all of 
this additional information about other compilers that also do this 
optimization?

Here is the code generated:

; Listing generated by Microsoft (R) Optimizing Compiler Version 
14.00.50727.762
...
; Function compile flags: /Ogtpy

...
; 2    :   len = 1 << 30;
; 3    :   if (buf + len < buf)
; 4    :     return 1;
; 5    :
; 6    :
; 7    :   return 0;

	xor	eax, eax

; 8    : }

--
Mark Mitchell
CodeSourcery
mark@codesourcery.com
(650) 331-3385 x713