GCC 3.0.3 PRs

[Paolo Carlini]

Joe Buck wrote:

> >
> > The only two PRs that remain on my "really wish we could fix these" list
> > are PR3393 (a Fortran regression relative to GCC 3.0) and PR3720
> > (num_get is (partially) broken in V3).
> >
> > Is there any chance of getting those fixed in the next few days?
>
> I think that 3720 should be considered a must-fix.  If people use stream
> I/O in security-critical programs, this kind of buffer overflow could lead
> to root exploits in programs that would be perfectly safe with a
> correct iostreams implementation.  I don't think it's ethical for us to
> ship with such a bug.

Well, it looks like Benjamin has *already* fixed it for the mainline:

    http://gcc.gnu.org/ml/gcc-patches/2001-12/msg00814.html

Apparently, there is a minor nit remaining
(http://gcc.gnu.org/ml/gcc-prs/2001-12/msg00432.html) but otherwise, it suffices to
backport it to gcc-3_0

Cheers,
Paolo.