US-CERT Vulnerability Note VU#162289

[Paul Koning]

>>>>> "Ian" == Ian Lance Taylor <iant@google.com> writes:

 Ian> "Robert C. Seacord" <rcs@cert.org> writes:
 >>> What you really mean is, "Use an older GCC or some other compiler
 >>> that is known not to take advantage of this optimization."
 >>> 
 >> i think we mean what we say, which is "*Avoid newer versions of
 >> gcc" and *"avoiding the use of gcc versions 4.2 and later."  i
 >> don't see any verbiage that says "use a different compiler".

 Ian> I know I'm biased, but I think "use a different compiler" is
 Ian> clearly implied by the text of the advisory.  If the advisory
 Ian> mentioned that other compilers also implement the same
 Ian> optimization, then that implication would not be there.

I don't know if you're biased, actually.  

My reading is the same.  If the recommendation is "avoid GCC 4.2 or
later" that translates to "use a compiler other than GCC 4.2 or later"
(that's just standard set algebra).  Clearly that set includes:

a. GCC 4.1 or before
b. Compilers other than GCC

So the CERT note as worded is recommending (a) or (b) as workarounds.
And it is clear that (b) is NOT a correct workaround.  

Therefore the text of the note as currently worded is wrong and has to
be repaired.

   paul