Bug#708164: nginx proxy_pass buffer overflow (CVE-2013-2070)

2013-06-12 Thread steven hay
I believe I may have found a way around inspecting the compiled code for this check.  The GNU compiler has the following option: -fwrapv This option instructs the compiler to assume that signed arithmetic overflow of addition, subtraction and multiplication wraps around using twos-complement

Bug#708164: nginx proxy_pass buffer overflow (CVE-2013-2070)

2013-06-12 Thread steven hay
I understand if this patch may not be 100% correct, but if I read the references correctly, the error is more of theoretical than practical concern since this particular compiler optimization is not likely to be implemented in the GNU compiler. Do we really think that GNU would include an optimi