GCC and pointer overflows

[Lubomir Kundrak]

On Thu, 2008-04-17 at 09:03 +0200, Gianluca Sforna wrote:
> I just read this news on LWN ( BTW, thanks to Jeff for providing me a
> free subscription... )
> 
> Are our packages affected by this gcc "feature" ?
> 
> http://www.kb.cert.org/vuls/id/162289
> 
> In other words, do our default compilation flags lessen or nullify the
> impact of that problem?

This is certainly not a security vulnerability and Fedora did not
consider it as such. It is likely that most of Fedora 9 packages are
compiled with this bug, but it's certainly not worth recompiling them to
fix it and will most likely have no consequences at all.

Fedora 8 gcc and packages did not have this problem. A first glance I do
not see anything in Fedora 9 gcc changelog that would say this is fixed.
It should be probably easy for you to check it yourself -- proof of
concept for 32 bit architectures is depicted in the advisory.

Regards,
-- 
Lubomir Kundrak (Red Hat Security Response Team)