Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Ian Lance Taylor
Andreas Bogk <[EMAIL PROTECTED]> writes: > The case is clear when an if branch is folded away, because some > comparison is folded that would not have been under twos-complement > semantics. This is a pattern that probably doesn't happen all that much > in code out there, except in post-facto ove

Re: raising minimum version of Flex

2007-01-22 Thread Ben Elliston
On Mon, 2007-01-22 at 15:39 -0800, Mike Stump wrote: > On Jan 21, 2007, at 11:48 PM, Ian Lance Taylor wrote: > > That doesn't sound right. It see flex being run every time I create a > > new object directory, even though I don't modify the flex input files. > > Sounds like a bug. I did a quick c

Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Andreas Bogk
Joe Buck wrote: > You appear to mistakenly believe that wrapping around on overflow is a > more secure option. It might be, but it usually is not. There are many > CERT security flaws involving integer overflow; the fact that they are > security bugs has nothing to do with the way gcc generates c

Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Joe Buck
On Mon, Jan 22, 2007 at 06:48:16PM -0500, Andreas Bogk wrote: > Ian Lance Taylor wrote: > > I just want to report that I have a working patch to generate warnings > > every time gcc modifies code relying on the fact that signed overflow > > is undefined, except for cases where signed loop indexes a

Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Andreas Bogk
Ian Lance Taylor wrote: > I just want to report that I have a working patch to generate warnings > every time gcc modifies code relying on the fact that signed overflow > is undefined, except for cases where signed loop indexes are assumed > to not wrap around. I plan to start submitting this patc

Re: raising minimum version of Flex

2007-01-22 Thread Mike Stump
On Jan 21, 2007, at 11:48 PM, Ian Lance Taylor wrote: That doesn't sound right. It see flex being run every time I create a new object directory, even though I don't modify the flex input files. Sounds like a bug. I did a quick check with a contrib/gcc_update -- touch and a c,treelang build

Re: raising minimum version of Flex

2007-01-22 Thread Ben Elliston
Thanks all for the discussion. I think we can conclude that it's not safe to require a newer version of Flex. I withdraw my patch. Cheers, Ben

gcc-4.1-20070122 is now available

2007-01-22 Thread gccadmin
Snapshot gcc-4.1-20070122 is now available on ftp://gcc.gnu.org/pub/gcc/snapshots/4.1-20070122/ and on various mirrors, see http://gcc.gnu.org/mirrors.html for details. This snapshot has been generated from the GCC 4.1 SVN branch with the following options: svn://gcc.gnu.org/svn/gcc/branches

Re: Gcc-4.1.1: Build error for arm-target

2007-01-22 Thread Thomas Meyer
Thomas Meyer schrieb: Thomas Meyer schrieb: Thomas Meyer schrieb: Hello. I try to build a cross compiler for this target: arm-uclinux-uclibc: First the build fails because of a wrong config entry in config.gcc: This should fix this: diff --git a/gcc/config.gcc b/gcc/config.gcc index 033cc3d

Re: Gcc-4.1.1: Build error for arm-target

2007-01-22 Thread Thomas Meyer
Thomas Meyer schrieb: Thomas Meyer schrieb: Hello. I try to build a cross compiler for this target: arm-uclinux-uclibc: First the build fails because of a wrong config entry in config.gcc: This should fix this: diff --git a/gcc/config.gcc b/gcc/config.gcc index 033cc3d..378a92d 100644 --- a/

Re: Gcc-4.1.1: Build error for arm-target

2007-01-22 Thread Thomas Meyer
Thomas Meyer schrieb: Hello. I try to build a cross compiler for this target: arm-uclinux-uclibc: First the build fails because of a wrong config entry in config.gcc: This should fix this: diff --git a/gcc/config.gcc b/gcc/config.gcc index 033cc3d..378a92d 100644 --- a/gcc/config.gcc +++ b/gc

Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Joe Buck
On Mon, Jan 22, 2007 at 11:16:06AM -0800, Ian Lance Taylor wrote: > The new -Wstrict-overflow > warning will issue warnings for each case where gcc assumes that > signed overflow is undefined. > > To be clear, this -Wstrict-overflow option generates a lot of false > positives. That is becau

The Linux binutils 2.17.50.0.10 is released

2007-01-22 Thread H. J. Lu
This is the beta release of binutils 2.17.50.0.10 for Linux, which is based on binutils 2007 0122 in CVS on sourceware.org plus various changes. It is purely for Linux. Starting from the 2.17.50.0.4 release, the default output section LMA (load memory address) has changed for allocatable sections

Gcc-4.1.1: Build error for arm-target

2007-01-22 Thread Thomas Meyer
Hello. I try to build a cross compiler for this target: arm-uclinux-uclibc: First the build fails because of a wrong config entry in config.gcc: This should fix this: diff --git a/gcc/config.gcc b/gcc/config.gcc index 033cc3d..378a92d 100644 --- a/gcc/config.gcc +++ b/gcc/config.gcc @@ -691,7

Re: Signed int overflow behaviour in the security context

2007-01-22 Thread Ian Lance Taylor
Andreas Bogk <[EMAIL PROTECTED]> writes: > It is my fear that the existing behaviour of gcc when used without > -fwrapv breaks a lot of code out there that was written with the > implicit assumption that signed ints would overflow the way the > underlying machine integers do. More importantly, so

Re: raising minimum version of Flex

2007-01-22 Thread Joseph S. Myers
On Mon, 22 Jan 2007, Ben Elliston wrote: > I submitted a patch to gengtype-lex.l last week to gcc-patches. The > patch uses some flex %option directives. Ian Taylor asked me to check > if the patch passed through flex 2.5.4, which is the current minimum > required version. It didn't work. > >

Re: raising minimum version of Flex

2007-01-22 Thread Tom Tromey
> "Ian" == Ian Lance Taylor <[EMAIL PROTECTED]> writes: Ben> I think it's worth raising the minimum required version from 2.5.4 to Ben> 2.5.31. Ian> I want to point out that Fedora Core 5 appears to still ship flex Ian> 2.5.4. At least, that is what flex --version reports. When this came up

Re: Getting a tree node for a field of a variable

2007-01-22 Thread Ferad Zyulkyarov
typedef struct MyType { int field1; int field2; } MyType *var; Finally, I found a way to get the tree node for "var->field1" assuming that we compile the code above. Here is an example: tree var_decl = lookup_name(get_identifier("var")); tree var_field1 = build_component_ref(build_indirect

Signed int overflow behaviour in the security context

2007-01-22 Thread Andreas Bogk
Dear compiler hackers, I feel compelled to revisit a topic that has already been extensively discussed on this mailing list, unfortunately with an outcome that is highly dangerous to the security of about any existing system compiled with gcc in the world. It is my fear that the existing behaviou

Re: raising minimum version of Flex

2007-01-22 Thread Marcin Dalecki
Wiadomość napisana w dniu 2007-01-22, o godz06:49, przez Ben Elliston: I think it's worth raising the minimum required version from 2.5.4 to 2.5.31. The latter version was released in March, 2003, so it is hardly bleeding edge. Your definition of bleeding edge doesn't fit mine: $ flex --

Fix libgcj build failure on Alpha

2007-01-22 Thread Andrew Haley
write_barrier() is missing in the libgcj build. Fixed thusly. Andrew. 2007-01-22 Andrew Haley <[EMAIL PROTECTED]> * sysdep/alpha/locks.h (write_barrier): New. Index: locks.h === --- locks.h (revision 120859) +++ loc

Re: raising minimum version of Flex

2007-01-22 Thread Václav Haisman
Gerald Pfeifer wrote: [...] > openSUSE 10.2 now comes with flex 2.5.33, but FreeBSD, for example, still > is at flex 2.5.4. Just some additional data pointes... FreeBSD has version 2.5.33 as textproc/flex port. -- Vaclav Haisman signature.asc Description: OpenPGP digital signature

Re: raising minimum version of Flex

2007-01-22 Thread Gerald Pfeifer
On Mon, 21 Jan 2007, Ian Lance Taylor wrote: > That doesn't sound right. It see flex being run every time I create a > new object directory, even though I don't modify the flex input files. > We ship gengtype-lex.c with releases, so people building the compiler > from releases shouldn't have to wo