bugtraq - Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 18 Apr 2006 11:21:40 +0200
From: Gabor Gombas <gombasg@...aki.hu>
To: Felix von Leitner <felix-bugtraq@...e.de>
Cc: bugtraq@...urityfocus.com
Subject: Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk


On Mon, Apr 17, 2006 at 10:03:54PM +0200, Felix von Leitner wrote:

> static inline int range_ptrinbuf(const void* buf,unsigned long len,const void* ptr) {
>   register const char* c=(const char*)buf;      /* no pointer arithmetic on void* */
>   return (c && c+len>c && (const char*)ptr-c<len);
> }

$ gcc-4.1 -W -Wall t.c
t.c:5: warning: comparison between signed and unsigned

> gcc 3 compiles this code correctly.  I tested this on x86 and amd64.
> I mention this here because "c+len>c" is the code with which you would
> typically check for integer overflows, which is a check that for example
> an IP stack would do, or Samba.

AFAIK C99 states that the value of that expression is "undefined". So
IMHO this is an application bug, not a bug in gcc.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------