US-CERT Vulnerability Note VU#162289

[Robert Dewar]

Gerald.Williams@infineon.com wrote:

> It's already been acknowledged that the source code is wrong
> to assume that the compiler knows about wrapping of pointers.
> The real issue at this stage is how to warn users who may be
> using GCC and implicitly relying on its old behavior, without
> unintentionally pushing people in the wrong direction. Since
> this optimization is performed by many other compilers, the
> ship has already sailed on this one, so to speak.

that's a strong argument I agree

> [In fact,
> after GCC does something to warn users about this, it'll be
> much "safer" than those other compilers.]

For sure you want a warning, the compiler should never be
removing explicit tests in the users code without generating
a warning I would think.
> 
> I agree that on the face of it, it seems like you wouldn't
> want to optimize away tests like this when you can know that
> pointer arithmetic really does look the same as unsigned
> arithmetic (for a particular architecture, etc.). However,
> sometimes an optimization may enable thirty more, so I for
> one am not going to argue against it. Especially not when
> many other compilers do it also.

Not sure I agree with that, but I can certainly live with
a warning.
> 
> -Jerry
> 
> P.S. I'm having some déjà vu, recalling discussions back in
> the GCC 2.7 days about whether it was really OK to change
> the behavior for signed arithmetic to support devices with
> saturation. We've come a long way since then.

:-)