GCC 3.0.3 PRs
Joe Buck
jbuck@synopsys.COM
Fri Dec 7 14:04:00 GMT 2001
>
> The only two PRs that remain on my "really wish we could fix these" list
> are PR3393 (a Fortran regression relative to GCC 3.0) and PR3720
> (num_get is (partially) broken in V3).
>
> Is there any chance of getting those fixed in the next few days?
I think that 3720 should be considered a must-fix. If people use stream
I/O in security-critical programs, this kind of buffer overflow could lead
to root exploits in programs that would be perfectly safe with a
correct iostreams implementation. I don't think it's ethical for us to
ship with such a bug.
Also, it shouldn't be hard to fix it once agreement is reached on how.
All that's needed is an upper bound on buffer size.
More information about the Gcc
mailing list