Description
fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."
References
- 20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763
- 20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- 20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356896
- 20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- [gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling broken mailing-list
- http://gcc.gnu.org/viewcvs/branches/gcc-4_1-branch/gcc/fold-const.c?r1=110549&r2=112698&pathrev=112698&diff_format=h
- [gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken mailing-list