Security vulernarability or security feature? VU#162289

[Ian Lance Taylor]

"Robert C. Seacord" <rcs@cert.org> writes:

> The original impetus for this came from a check in a sprint() function 
> from Plan 9.  Because of the API, there was no way to test if the len 
> was out of bounds, but the developers wanted to make sure they weren't
> wrapping the stack on some architectures that have their stacks in
> high memory.

The code in question is here:

http://groups.google.com/group/comp.os.plan9/msg/d5c0a5836622f0c9

That code can be rewritten in standard conformant C.  For example:

  len = min(1 << 30, - (uintptr_t) buf - 1);

I will update you with the status of the new gcc warnings about this
code when the work is complete in all active branches.

Ian