oss-sec mailing list archives
Re: gcc 4.2 optimizations and integer overflow checks
From: Solar Designer <solar () openwall com>
Date: Mon, 7 Apr 2008 23:00:36 +0400
On Mon, Apr 07, 2008 at 06:39:33PM +0200, Nico Golde wrote:
* Steven M. Christey <coley () linus mitre org> [2008-04-07 18:24]:While an unusual bug, we decided to assign a CVE for it.
...
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1685 Reference: CERT-VN:VU#162289 Reference: URL:http://www.kb.cert.org/vuls/id/162289[...] Please add http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763 to the references.
FWIW, there are also actual gcc bugs that cause miscompiles - and they may potentially result in security vulnerabilities - yet I am not sure if "proactively" treating the gcc bugs themselves as security issues is appropriate. This is interesting - here we have a gcc non-bug that deserves a CERT Vulnerability Note and a CVE number (which I agree with), yet actual bugs might not deserve such treatment. Here's an example of an actual bug - http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26587 - this one caused my Blowfish implementation to be miscompiled, possibly making the cipher weaker (in case the misbehavior went unnoticed). By the way, I was surprised by how quickly this one was confirmed (16 minutes) and fixed (less than a day). Alexander
Current thread:
- gcc 4.2 optimizations and integer overflow checks Josh Bressers (Apr 07)
- Re: gcc 4.2 optimizations and integer overflow checks Steven M. Christey (Apr 07)
- Re: gcc 4.2 optimizations and integer overflow checks Nico Golde (Apr 07)
- Re: gcc 4.2 optimizations and integer overflow checks Solar Designer (Apr 07)
- Re: gcc 4.2 optimizations and integer overflow checks Nico Golde (Apr 09)
- Re: gcc 4.2 optimizations and integer overflow checks Steven M. Christey (Apr 10)
- Re: gcc 4.2 optimizations and integer overflow checks Marcus Meissner (Apr 18)
- Re: gcc 4.2 optimizations and integer overflow checks Solar Designer (Apr 18)
- Re: gcc 4.2 optimizations and integer overflow checks Richard Guenther (Apr 20)
- Re: gcc 4.2 optimizations and integer overflow checks Nico Golde (Apr 07)
- Re: gcc 4.2 optimizations and integer overflow checks Steven M. Christey (Apr 07)