Re: Security vulernarability or security feature? VU#162289

4 msg	libstdc++ svn head broken
1 msg	gcc-4.4-20080425 is now available
3 msg	More on GCC Back Ends
2 msg	Fix for libstdc++/35887 broke build for single-...
1 msg	ARCtangent-A4 support
1 msg	gcc-4.3-20080424 is now available

Security vulernarability or security feature?
\ Ralph Loader (24 Apr 2008)
. \ Robert C. Seacord (24 Apr 2008)
. . \ Ralph Loader (24 Apr 2008)
. . . \ Prateek Saxena (24 Apr 2008)
. . . . \ Ralph Loader (24 Apr 2008)
. . . . \ James Courtier-Dutton (27 Apr 2008)
. . . . . \ Robert Dewar (27 Apr 2008)
. . . . . . \ James Courtier-Dutton (27 Apr 2008)
. . . . . . . \ Robert Dewar (27 Apr 2008)
. . . . . . . \ Paolo Bonzini (27 Apr 2008)
. . . . . . . \ Paolo Bonzini (27 Apr 2008)
. . . . . . . . \ Robert Dewar (27 Apr 2008)
. . \ NightStrike (25 Apr 2008)
. \ Ralph Loader (24 Apr 2008)
. . \ Robert C. Seacord (24 Apr 2008)
. . . \ Ralph Loader (25 Apr 2008)
. . . . \ Robert C. Seacord (25 Apr 2008)
. . . . . \ Joe Buck (25 Apr 2008)
. . . . . \ Ian Lance Taylor (29 Apr 2008)

5 msg	Use of option -fprofile-arcs is not compatible ...
2 msg	Question about compilation details
35 msg	Re: IRA for GCC 4.4
2 msg	Help me with the patterns
1 msg	gcc-4.2-20080423 is now available
10 msg	dg-skip-if on powerpc when multiple cpu cflags ...
2 msg	GCC port on PIC18xxx MCUs
2 msg	I386.md: _mixed and _sse
8 msg	no mul/div instruction
3 msg	Google Summer of Code 2008: seven approved appl...
2 msg	namelookup bug in gcc?
3 msg	How to insert functions?
1 msg	gcc-4.1-20080421 is now available

Subject:	Re: Security vulernarability or security feature? VU#162289
Group:	Gcc
From:	Ian Lance Taylor
Date:	29 Apr 2008

"Robert C. Seacord" <rcs> writes:

> The original impetus for this came from a check in a sprint() function
> from Plan 9. Because of the API, there was no way to test if the len
> was out of bounds, but the developers wanted to make sure they weren't
> wrapping the stack on some architectures that have their stacks in
> high memory.

The code in question is here:

http://groups.google.com/group/comp.os.plan9/msg/d5c0a5836622f0c9

That code can be rewritten in standard conformant C. For example:

len = min(1 << 30, - (uintptr_t) buf - 1);

I will update you with the status of the new gcc warnings about this
code when the work is complete in all active branches.

Ian