On Thu, Mar 06, 2008 at 01:06:17PM +0100, Richard Guenther wrote: > On 06 Mar 2008 12:45:57 +0100, Andi Kleen <[EMAIL PROTECTED]> wrote: > > Andrew Haley <[EMAIL PROTECTED]> writes: > > > > > > I suppose one could apply the precautionary principle, but those systems > > that > > > don't update kernels won't update gcc either, so the solution won't work. > > > > You seem to assume that running a gcc 4.3 compiled binary requires a > > gcc update. That is not necessarily true. > > It (sometimes) requires a libgcc and libstdc++ update.
"Sometimes" is correct; many users commonly run newer compilers on older distros, with LD_LIBRARY_PATH set to pick up the correct C++ support library. This is particularly common on servers, where you don't want to mess with a working system but you might need to run newer code. So, we've been arguing for a while, so the question is what to do. Using a principle based on the old IETF concept of being liberal in what you accept, and conservative in what you send, I think that both the Linux kernel and gcc should fix the problem. The kernel should fix the information leak, and gcc should remove the assumption that the direction flag is set in a given direction on function entry. The gcc patch will be too late for 4.3.0, but it would be on the 4.3 branch, and we would recommend that distros pick it up for any compilers they ship.
