oss-security - Re: gcc 4.2 optimizations and integer overflow checks

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0804071216410.15662@faron.mitre.org>
Date: Mon, 7 Apr 2008 12:17:09 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: gcc 4.2 optimizations and integer overflow checks

While an unusual bug, we decided to assign a CVE for it.

- Steve

======================================================
Name: CVE-2008-1685
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1685
Reference: CERT-VN:VU#162289
Reference: URL:http://www.kb.cert.org/vuls/id/162289

gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not
used, considers the sum of a pointer and an int to be greater than or
equal to the pointer, which might remove length testing code that was
intended as a protection mechanism against integer overflow and buffer
overflow attacks.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.