US-CERT Vulnerability Note VU#162289

[Robert C. Seacord]

Joe,

Response below.
> On Mon, Apr 07, 2008 at 01:28:21PM -0400, Robert C. Seacord wrote:
>   
>> You are also right that the popularity of gcc is one of the reasons we 
>> decided to publish on this.  If you identify other compilers that a) are 
>> relatively popular, b) have changed their behavior recently, and c) 
>> silently optimize out overflow checks we will consider publishing 
>> vulnerability notes for those compilers as well.
>>     
>
> What is the justification for requirement b)?  We identified two distinct
> proprietary compilers that also do this optimization, but it isn't a
> recent change in behavior.
>   
my thinking is that if this behavior has been in place for many years, 
for example, users will have had the opportunity to discover the changed 
behavior.  our goal here is to disseminate this information more quickly.

on a related topic, we are trying to produce secure coding standards 
that deal with these issues in general.

we've begun the additional of several rules around the topic of pointer 
arithmetic following the release of this vul note. 

The most relevant is titled "ARR38-C. Do not add or subtract an integer 
to a pointer if the resulting value does not refer to an element within 
the array" and can be found here:

https://www.securecoding.cert.org/confluence/x/SgHm

We are hopeful that these rules and recommendations will help developers 
address these issues in the general sense.

rCs

-- 
Robert C. Seacord
Senior Vulnerability Analyst
CERT/CC 

Work: 412-268-7608
FAX: 412-268-6989