BugTraq
gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 17 2006 08:03PM
Felix von Leitner (felix-bugtraq fefe de) (6 replies)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 18 2006 07:16PM
Florian Weimer (fw deneb enyo de)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 18 2006 09:21AM
Gabor Gombas (gombasg sztaki hu)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 18 2006 07:45AM
Alexander Klimov (alserkli inbox ru)
On Mon, 17 Apr 2006, Felix von Leitner wrote:
> static inline int range_ptrinbuf(const void* buf,unsigned long len,const void* ptr) {
> register const char* c=(const char*)buf; /* no pointer arithmetic on void* */
> return (c && c+len>c && (const char*)ptr-c<len);
> }
>
> [...]
>
> assert(range_ptrinbuf(buf,(unsigned long)-1,buf+1)==0);
>
> Imagine my surprise when this assertion failed. [...] "c+len>c" is
> the code with which you would typically check for integer overflows,

Most commonly integer overflows happens with integers (not pointers).
Try to convert pointers to unsigned (this should work, although it is
not portable).

According to the C standard the semantic of pointers is different from
the semantic of integers, so TTBOMK gcc is doing the right thing.

<http://www-ccs.ucsd.edu/c/express.html>:

You can add an integer to a value of type pointer to object. If the
value of the pointer is the address of an array element, then adding
one to the value yields the address of the next array element. [...]
If you form any other address that does not designate an element of
the array object (by adding an integer to a pointer), the result is
undefined.

You can compare two pointer values only if they are the addresses of
elements within (or just beyond) the same array object.

--
Regards,
ASK

[ reply ]
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 18 2006 12:15AM
Nate Eldredge (nge cs hmc edu)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 17 2006 11:57PM
Michael Chamberlain (michael chamberlain net au)
Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk Apr 17 2006 10:26PM
Forrest J. Cavalier III (mibsoft mibsoftware com)


 

Privacy Statement
Copyright 2010, SecurityFocus