[PATCH] Document arithmetic overflow semantics

[Joseph S. Myers]

On Thu, 13 Feb 2003, Florian Weimer wrote:

> <http://cert.uni-stuttgart.de/advisories/c-integer-overflow.php>
> 
> The apt_get_chunk_size bug referenced in the end was actually
> exploited by a worm.
> 
> Typical C programmers do not understand the issue.  The rebel inside
> still thinks that GCC should optimize aggressively in this area, just
> to prove the point that C is unusable for any real work, but I doubt
> that this is practical.

We should document options encouraged for compiling secure code.  This
would include both warning options (-Wall -Wformat-security
-Wmissing-format-attribute ...) and code-generation options, such as
-ftrapv (trap on signed overflow) and, when we eventually get it in
mainline, some bounded pointer options (-fmudflap?).

(With flag bits on operations that might overflow, we can easily also add
an option -fsigned-overflow-defined for the benefit of anyone who wants
that language dialect.)

-- 
Joseph S. Myers
jsm28@cam.ac.uk