GCC 3.0.3 PRs
Mark Mitchell
mark@codesourcery.com
Fri Dec 7 15:11:00 GMT 2001
--On Friday, December 07, 2001 01:58:38 PM -0800 Joe Buck
<jbuck@synopsys.COM> wrote:
>
>> Is there any chance of getting those fixed in the next few days?
>
> I think that 3720 should be considered a must-fix. If people use stream
> I/O in security-critical programs, this kind of buffer overflow could lead
> to root exploits in programs that would be perfectly safe with a
> correct iostreams implementation. I don't think it's ethical for us to
> ship with such a bug.
Well, OK. Of course, any code-gen bug could lead to the same kinds
of problems. Still, I see your point.
> Also, it shouldn't be hard to fix it once agreement is reached on how.
> All that's needed is an upper bound on buffer size.
Benjamin, can you work on this ASAP? Otherwise, I'll threatent to
engineer my own quick fix for the branch to make Joe happy, but you'll
probably not like how I do it. :-)
Thanks,
--
Mark Mitchell mark@codesourcery.com
CodeSourcery, LLC http://www.codesourcery.com
More information about the Gcc
mailing list