2008/11/16 Dominique Pelle <[EMAIL PROTECTED]>: > 2008/11/16 Bram Moolenaar <[EMAIL PROTECTED]>: > >> Apparently -fstack-protector is on by default. The "inline-functions" >> apparently does something to reveal the size of the destination to >> strcpy(). That's a bit unexpected though. >> >> Why not compile Vim with -fno-stack-protector ? Can you try with -O3 >> and that flag? It's not clear to me that this stack-protector function >> is what actually adds the check for the array size. > > Adding -fno-stack-protector does not help either (same warning + > same crash). But reading through the man page of gcc, I stumbled > upon this in the section about -O2: > > ================================================== > NOTE: In Ubuntu 8.10 and later versions, -D_FORTIFY_SOURCE=2 > is set by default, and is activated when -O is set to 2 or higher. > This enables additional compile-time and run-time checks for several > libc functions. To disable, specify either -U_FORTIFY_SOURCE or > -D_FORTIFY_SOURCE=0. > ================================================== > > So I tried adding compiling with -O3 -D_FORTIFY_SOURCE=0 > and it makes it work! > > So far I don't observe anything wrong so fat with > -O3 -D_FORTIFY_SOURCE=0. 'make test' succeeds > in every tests. > > I'm not 100% sure whether adding -D_FORTIFY_SOURCE=0 silents > a real bug, or whether it was reporting a spurious error (more likely > from looking at vim code). But even if it silents a spurious bug in this > case, adding -D_FORTIFY_SOURCE=0 may also silent other real > bugs, which is a shame. I'll add the info to the gcc bug buzilla, but > it was already and quickly marked as INVALID, so I don't expect > much there. > > -- Dominique
I should add that building with -O3 -D_FORTIFY_SOURCE=1 also works which is better. Reading about _FORTIFY_SOURCE in the following link, everything makes sense now. Snippet from http://mail-index.netbsd.org/tech-userlevel/2007/05/23/0001.html =============================================== The diffence between -D_FORTIFY_SOURCE=1 and -D_FORTIFY_SOURCE=2 is e.g. for struct S { struct T { char buf[5]; int x; } t; char buf[20]; } var; With -D_FORTIFY_SOURCE=1, strcpy (&var.t.buf[1], "abcdefg"); is not considered an overflow (object is whole VAR), while with -D_FORTIFY_SOURCE=2 strcpy (&var.t.buf[1], "abcdefg"); will be considered a buffer overflow. =============================================== This example is very close to what vim does. So it makes sense that -D_FORTIFY_SOURCE=2 detects an overflow, while -D_FORTIFY_SOURCE=1 does not. Adding -D_FORTIFY_SOURCE=1 to Vim makefile sounds like a good idea. -- Dominique --~--~---------~--~----~------------~-------~--~----~ You received this message from the "vim_dev" maillist. For more information, visit http://www.vim.org/maillist.php -~----------~----~----~----~------~----~------~--~---
