[Bug middle-end/68069] -fstack-protector does not protect from buffer overflow attack

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68069

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Resolving as invalid on the basis of comment #3 (and due to no
counterargument).  

The problem is caught by -fsanitize=undefined (although the handling isn't the
most elegant -- the program is stuck in the fscanf loop and never terminates).

$ gcc -fsanitize=undefined t.c && ./a.out 
t.c: In function ‘f’:
t.c:13:20: warning: cast from pointer to integer of different size
[-Wpointer-to-int-cast]
     printf("%d\n", (int) f2);
                    ^
t.c:19:11: warning: assignment makes pointer from integer without a cast
[-Wint-conversion]
  arr[++i] = cur;
           ^
4196614
1
t.c:19:5: runtime error: index 2 out of bounds for type 'int *[1]'
t.c:19:11: runtime error: store to address 0x7ffe793c7f60 with insufficient
space for an object of type 'int *'
0x7ffe793c7f60: note: pointer points here
 02 00 00 00  00 00 00 00 00 00 00 00  10 08 40 00 00 00 00 00  80 7f 3c 79 fe
7f 00 00  37 0a 40 00
              ^ 
4196614