Robert C. Seacord wrote:
The advisory suggests that people not use GCC.
no, it does not. it suggests they may not want to use the latest
versions. this is one possible work around. we never say "use another
compiler".
Fair enough. However, it does suggest that recent versions of GCC are
unique in this behavior, when in fact this is an optimization made by
many compilers.
Why not change the overview to something like:
"Some compilers (including, at least, GCC, PathScale, and xlc)
optimize away incorrectly coded checks for overflow. Applications
containing these incorrectly coded checks may be vulnerable if
compiled with these compilers."
ok, i'll review again for tone. generally we don't try to make these
notes overly broad; they are only meant to draw attention to a specific
issue.
Thank you. I understand the specific-issue criteria, but I think that
in this case the specific issue should be the incorrectly coded overflow
checks -- not the compiler.
I think it's a very good idea to list compilers which do and do not do
the optimization so that people who can't readily audit their code for
the problem can use safe fallback compiler. I certainly have no
objection to GCC 4.2+ being mentioned as a compiler that performs this
optimization, or noting that, as a result, incorrect programs may have
security bugs. But, given the information we have now about how many
compilers do this, I think that focusing on GCC exclusively is misleading.
Thanks,
--
Mark Mitchell
CodeSourcery
[EMAIL PROTECTED]
(650) 331-3385 x713
