[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 18 Apr 2008 13:18:32 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: gcc 4.2 optimizations and integer overflow checks
On Thu, Apr 10, 2008 at 02:31:13PM -0400, Steven M. Christey wrote:
>
> On Wed, 9 Apr 2008, Nico Golde wrote:
>
> > Hi Steven,
> > * Steven M. Christey <coley@...us.mitre.org> [2008-04-07 18:24]:
> > > While an unusual bug, we decided to assign a CVE for it.
> > [...]
> > Just stumbled upon CVE-2006-1902, look spretty much the same
> > to me, is this a dup?
>
> Nice find!
>
> My immediate suspicion is that they're not the same, based solely on
> affected versions - CVE-2008-1685 has a specific affected version range
> because it changed behaviors in 4.2.0. Maybe that change came out of
> followup analysis stemming from CVE-2006-1902.
>
> But, I'm not completely sure. Solar?
They are mostly unrelated, one is about signed integers, while the
new one is "pointer + offset" related.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
