US-CERT Vulnerability Note VU#162289

[Mark Mitchell]

Robert C. Seacord wrote:

>> The advisory suggests that people not use GCC.

> no, it does not.  it suggests they may not want to use the latest 
> versions.  this is one possible work around.  we never say "use another 
> compiler".

Fair enough.  However, it does suggest that recent versions of GCC are 
unique in this behavior, when in fact this is an optimization made by 
many compilers.

>> Why not change the overview to something like:
>>
>> "Some compilers (including, at least, GCC, PathScale, and xlc) 
>> optimize away incorrectly coded checks for overflow.  Applications 
>> containing these incorrectly coded checks may be vulnerable if 
>> compiled with these compilers."

> ok, i'll review again for tone.  generally we don't try to make these 
> notes overly broad; they are only meant to draw attention to a specific 
> issue.

Thank you.  I understand the specific-issue criteria, but I think that 
in this case the specific issue should be the incorrectly coded overflow 
checks -- not the compiler.

I think it's a very good idea to list compilers which do and do not do 
the optimization so that people who can't readily audit their code for 
the problem can use safe fallback compiler.  I certainly have no 
objection to GCC 4.2+ being mentioned as a compiler that performs this 
optimization, or noting that, as a result, incorrect programs may have 
security bugs.  But, given the information we have now about how many 
compilers do this, I think that focusing on GCC exclusively is misleading.

Thanks,

-- 
Mark Mitchell
CodeSourcery
mark@codesourcery.com
(650) 331-3385 x713