Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 18 Apr 2008 13:18:32 +0200
From: Marcus Meissner <>
Subject: Re: gcc 4.2 optimizations and integer overflow checks

On Thu, Apr 10, 2008 at 02:31:13PM -0400, Steven M. Christey wrote:
> On Wed, 9 Apr 2008, Nico Golde wrote:
> > Hi Steven,
> > * Steven M. Christey <> [2008-04-07 18:24]:
> > > While an unusual bug, we decided to assign a CVE for it.
> > [...]
> > Just stumbled upon CVE-2006-1902, look spretty much the same
> > to me, is this a dup?
> Nice find!
> My immediate suspicion is that they're not the same, based solely on
> affected versions - CVE-2008-1685 has a specific affected version range
> because it changed behaviors in 4.2.0.  Maybe that change came out of
> followup analysis stemming from CVE-2006-1902.
> But, I'm not completely sure.  Solar?

They are mostly unrelated, one is about signed integers, while the
new one is "pointer + offset" related.

Ciao, Marcus

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.