https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67999
--- Comment #18 from Alexander Cherepanov <ch3root at openwall dot com> --- I guess nobody doubts that the current situation in gcc+glibc (and clang+glibc) should be fixed as valid programs are miscompiled. And it's easy to imagine security consequences of this when buffers have sizes controlled by attackers. The problem is not limited to the comparisons of the form 'p + a < p', all comparison of the form 'p + a < p + b' are probably miscompiled. And subtraction of pointers is problematic too: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=45779 The issue affects not only all 32-bit platforms (i386, x32, arm, etc.) but also 16-bit ones, right? Or all of them are dead? Recently even 18-bit one was mentioned... Whether gcc violates C11 or not is not clear. The standard mostly speaks about compiler+library. OTOH gcc can be used as a freestanding implementation and even in a hosted environment, in practice, AIUI there could be external objects, not from compiler or libc. Hence IMHO this limitation should at least be documented in a user-visible place. (The same for libc's: if they cannot deal with huge objects it should be documented even if they cannot create them.)
