RE: US-CERT Vulnerability Note VU#162289

2008-04-23 Thread Gerald.Williams
Dave Korn wrote: [ ... lots of exciting commentary on scientific method/etc. that I leave out for the protection of the innocent ... ] Huzzah! Way to stick it to the man! :-) :-) > This VU falls massively far below the standards we have come to expect > from CERT, and should be withdrawn and

RE: US-CERT Vulnerability Note VU#162289

2008-04-14 Thread Gerald.Williams
Robert Dewar wrote: > An optimziation is dubious to me if > > a) it produces surprising changes in behavior (note the importance of > the word surprising here) > > b) it does not provide significant performance gains (note the > importance of the word significant here). > > I find this optimizat

RE: US-CERT Vulnerability Note VU#162289

2008-04-11 Thread Gerald.Williams
Robert C. Seacord wrote: > this was only one of several solutions listed, and not the first one > listed. Yes, CERT did the right thing by recommending first that the code be changed (kudos for that). >> What you really mean is, >> "Use an older GCC or some other compiler that is known not to >>

RE: US-CERT Vulnerability Note VU#162289

2008-04-11 Thread Gerald.Williams
Robert C. Seacord wrote: > Here is another version of the program (same compiler version/flags). [...] > void test_signed(char *buf) { > signed int len; [...] > if((buf+len < buf) != ((uintptr_t)buf+len < (uintptr_t)buf)) > printf(" BUG!"); [...] > void test_unsigned(char *buf) { >

RE: US-CERT Vulnerability Note VU#162289

2008-04-09 Thread Gerald.Williams
Robert C. Seacord wrote: > void f(char *buf) { > unsigned int len = len = 0xFF00; > > if (buf+len < buf) puts("true"); > > } You need to be more precise. That is not the same example that you quoted for GCC. In fact, if you vary the criteria too much, you will find situations where GCC

RE: Progress on GCC plugins ?

2007-11-16 Thread Gerald.Williams
Much as I hate prolonging a probably-pointless discussion... I hope we aren't thinking about keeping things difficult for everybody simply because everybody includes some people who may want to take advantage of GCC in a proprietary way. In the long term, this only benefits the folks you'd be tryi

RE: Progress on GCC plugins ?

2007-11-16 Thread Gerald.Williams
Joe Buck wrote: > RMS believes that people who extend GCC, hoping to take their extensions > proprietary, and then finding that they can't, will then just decide to > contribute the code, if it is useful, since otherwise they can't > distribute and have to support it by themselves forever, or else

RE: Progress on GCC plugins ?

2007-11-09 Thread Gerald.Williams
Mark Mitchell wrote: > Anyhow, in practical terms, debating this here probably will have zero > impact on the outcome. The ball is in RMS' court, and SC members > (including myself) have made many of the arguments that have been made > in this thread. If people want to influence the FSF, the best