[Full-disclosure] Major gcc 4.1.1 and up security issue

[Valdis.Kletnieks at vt.edu]

On Mon, 15 Jan 2007 21:07:40 +0100, Felix von Leitner said:
> So, in my gnupg diff, I used code like this:
> 
>   assert(a+100 > a);

Note that if 'a' is a macro with side effects (the ++ and -- operators are
particularly famous for this), you may just have seriously buggered the program
while trying to secure it.

> I opened a gcc bug for this.  They told me that the C standard says
> integer overflow for signed integers in undefined and therefore gcc is
> right in doing this.

Unfortunately, they're totally right.

> I'm saying this will break tons of security checks in existing
> applications and will get people to get 0wned.  Please help make the gcc
> people fix this!

Probably not - a lot of programmers use 'unsigned int' specifically to avoid
the sorts of problems you're seeing here.  Or they learn to code their
tests correctly.

Freebie related floating-point testing issue:

int thesame(float a, float b)
{
        if (a == b)
                return 0;
        else return 1;
}
...
float x = 1.15; y=3.30;

	foo = thesame(2.0*x,y);

This will produce incorrect results on some machine due to rounding error
(twice 1.15 will likely be a bit or two different than 3.30).  As Fortran
geeks have known for over half a century, a better way to code this is:

	if (abs(a-b) < n*epsilon*a)

where 'epsilon' is the hardware constant defining the smallest number such
that 1+a is different from 1, and 'n' controls how many significant digits
we require in the test.





-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070116/4e945bc8/attachment.bin