Well this means that all debian 3.0 packages which have been compiled w/ gcc 2.95 might contain serious integer overflow problems regardless one thinks he does secure programming.

marco


Falk Hueffner wrote:
Marco Fabbricatore <[EMAIL PROTECTED]>, [EMAIL PROTECTED] schrieb am 05.01.05 
14:08:32:


Package: gcc
Version: 2.95.4 20011002

following function compiled w/ gcc -O

int foo(unsigned int a)
{
   if(a * sizeof(int) / sizeof(int) != a)
      return -1;
   return 0;
}

gcc optimizes the arithmetic overflow check away!


Indeed. This is fixed in the 3.x series. I suggest upgrading, since it seems 
unlikely
that somebody will find and backport the fix...

Falk








Reply via email to