oss-security - Re: gcc 4.2 optimizations and integer overflow checks

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 18 Apr 2008 13:18:32 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: gcc 4.2 optimizations and integer overflow checks

On Thu, Apr 10, 2008 at 02:31:13PM -0400, Steven M. Christey wrote:
> 
> On Wed, 9 Apr 2008, Nico Golde wrote:
> 
> > Hi Steven,
> > * Steven M. Christey <coley@...us.mitre.org> [2008-04-07 18:24]:
> > > While an unusual bug, we decided to assign a CVE for it.
> > [...]
> > Just stumbled upon CVE-2006-1902, look spretty much the same
> > to me, is this a dup?
> 
> Nice find!
> 
> My immediate suspicion is that they're not the same, based solely on
> affected versions - CVE-2008-1685 has a specific affected version range
> because it changed behaviors in 4.2.0.  Maybe that change came out of
> followup analysis stemming from CVE-2006-1902.
> 
> But, I'm not completely sure.  Solar?

They are mostly unrelated, one is about signed integers, while the
new one is "pointer + offset" related.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.