Re: [patch] Enable lightweight checks with _GLIBCXX_ASSERTIONS.

2015-09-09 Thread Florian Weimer
hat > decision right away. I think we should try with _FORTIFY_SOURCE first. The above case looks rather artificial. If there is a visible performance impact, maybe we can get the compiler to eliminate the vector bounds checks in many cases. -- Florian Weimer / Red Hat Product Security

Re: [patch] Enable lightweight checks with _GLIBCXX_ASSERTIONS.

2015-09-10 Thread Florian Weimer
On 09/10/2015 06:30 PM, Martin Sebor wrote: > On 09/09/2015 09:58 AM, Florian Weimer wrote: >> On 09/08/2015 05:45 PM, Jonathan Wakely wrote: >> >>>> I doubt we can achieve the complexity goals in all cases. I expect >>>> that >>>> >>

Re: [patch] Enable lightweight checks with _GLIBCXX_ASSERTIONS.

2015-09-14 Thread Florian Weimer
I expect the libstdc++ changes to be similar. Again, my main argument is that the main users of _FORTIFY_SOURCE are distributions, and they would inject whatever preprocessor macro enables the new libstdc++ checks anyway, so saving them that work would be preferable IMHO. -- Florian Weimer / Red Hat Product Security

Re: [C++ Patch] PR 53184 ("Unnecessary anonymous namespace warnings")

2015-09-14 Thread Florian Weimer
tion unit because any definition in another translation unit would be an ODR violation, so they can be put into the anonymous namespace themselves. -- Florian Weimer / Red Hat Product Security

Re: [PING^2] [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-11-02 Thread Florian Weimer
On 10/30/2012 05:30 PM, Florian Weimer wrote: On 10/30/2012 05:17 PM, Paolo Carlini wrote: Sorry, I don't know the code well enough to review your patch, but since I'm in CC, I still don't understand why, instead of adding a full libstdc++ testcase you are extending a C++ testca

Re: [PING^2] [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-11-05 Thread Florian Weimer
On 11/02/2012 01:14 PM, Paolo Carlini wrote: On 11/02/2012 01:09 PM, Florian Weimer wrote: I looked at this again and made a new copy of the test case instead. It has been successfully tested on x86_64-redhat-linux-gnu. Is this okay for trunk? Looks very nice to me, and after all the issue

Re: [PING^2] [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-11-06 Thread Florian Weimer
On 11/06/2012 04:55 PM, Jason Merrill wrote: On 11/05/2012 12:52 PM, Florian Weimer wrote: +// Avoid use of none-overridable new/delete operators in shared Typo: that should be "non-overridable" Jason Thanks, this patch fixes both instances. -- Florian Weimer / Red Hat Produc

Re: [PATCH] Vtable pointer verification, gcc changes (patch 2 of 2)

2012-11-08 Thread Florian Weimer
-free issues, heap spraying, or something else? -- Florian Weimer / Red Hat Product Security Team

Re: [PING^2] [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-11-08 Thread Florian Weimer
On 11/06/2012 05:01 PM, Florian Weimer wrote: On 11/06/2012 04:55 PM, Jason Merrill wrote: On 11/05/2012 12:52 PM, Florian Weimer wrote: +// Avoid use of none-overridable new/delete operators in shared Typo: that should be "non-overridable" Jason Thanks, this patch fixes both

Re: [PATCH] Attribute for unused warning for variables of non-trivial types

2012-11-09 Thread Florian Weimer
d-only, and the elements might be ignored.) -- Florian Weimer / Red Hat Product Security Team

Re: RFC: PATCH to add abi_tag attribute

2012-11-11 Thread Florian Weimer
on legacy headers, or some form of automated cross-translation-unit feedback. -- Florian Weimer / Red Hat Product Security Team

Re: RFC: PATCH to add abi_tag attribute

2012-11-23 Thread Florian Weimer
On 11/15/2012 02:51 AM, Jason Merrill wrote: On 11/11/2012 11:58 PM, Jason Merrill wrote: On 11/11/2012 08:01 AM, Florian Weimer wrote: I'm not sure if this sufficiently far-reaching. It seems that this doesn't allow me to implement a virtual function which takes a std::string pa

Re: RFC: PATCH to add abi_tag attribute

2012-11-28 Thread Florian Weimer
On 11/23/2012 03:24 PM, Jason Merrill wrote: On 11/23/2012 04:58 AM, Florian Weimer wrote: Okay, this might work in the sense that it flags the relevant cases. I'm still not convinced that this actually helps programmers that much because it pretty much separates the two worlds. If this i

Re: C++/v3 PATCH to add/throw std::bad_array_new_length

2013-05-06 Thread Florian Weimer
nition, which seems rather odd. I'm surprised that this even compiles. -- Florian Weimer / Red Hat Product Security Team

Re: C++/v3 PATCH to add/throw std::bad_array_new_length

2013-05-06 Thread Florian Weimer
On 05/06/2013 02:39 PM, Jason Merrill wrote: On 05/06/2013 05:46 AM, Florian Weimer wrote: Nice, this is simpler than expected. However, it makes the call sites even more bloated. Hmm, perhaps the checking should be wrapped in an inline function, so that the inliner can decide whether or not

Re: C++/v3 PATCH to add/throw std::bad_array_new_length

2013-05-13 Thread Florian Weimer
On 05/06/2013 05:56 PM, Jason Merrill wrote: On 05/06/2013 08:46 AM, Florian Weimer wrote: On 05/06/2013 02:39 PM, Jason Merrill wrote: On 05/06/2013 05:46 AM, Florian Weimer wrote: Nice, this is simpler than expected. However, it makes the call sites even more bloated. Hmm, perhaps the

Re: PATCH to implement C++14 VLA semantics

2013-05-13 Thread Florian Weimer
verflow. This whole feature seems rather poorly designed to me. The code size increase due to official VLA support in C++11y might come a bit as a surprise. But rereading N3639, there's no way around it, at least for expressions of signed types. -- Florian Weimer / Red Hat Product Security Team

Re: PATCH to implement C++14 VLA semantics

2013-05-13 Thread Florian Weimer
covers a tiny fraction of the problem. It's like bounds checking for arrays which only fails if the index is at least twice as large as the array length, IMHO. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] gcc/tree-complex.c: Fix minor typo in comment

2013-07-05 Thread Florian Weimer
On 07/05/2013 11:28 AM, Thomas Quinot wrote: 2013-07-06 Thomas Quinot gcc/ * tree-complex.c: Fix minor typo in comment OK to commit? I think this falls under the "obvious" rule. (But your date in the changelog is off.) -- Florian Weimer / Red Hat Product Security Team

Re: Go patch committed: Update libgo to 1.1.1

2013-07-16 Thread Florian Weimer
*bytes.Buffer The size of the public Decoder struct changes, and this size has been compiled into client code. -- Florian Weimer / Red Hat Product Security Team

Re: RFC: Gimple combine/folding interface

2013-07-22 Thread Florian Weimer
On 07/20/2013 02:09 AM, Andrew Pinski wrote: gimple_combine(bool reas) : nonzerobitsf(NULL), valueizerv(NULL), allow_full_reassiocation(reas) {} I think this constructor should be marked "explicit". -- Florian Weimer / Red Hat Product Security Team

[C, C++] Implement -Wstatic-local

2013-07-23 Thread Florian Weimer
on x86_64-redhat-linux-gnu. Okay for trunk? -- Florian Weimer / Red Hat Product Security Team gcc/ChangeLog: 2013-07-23 Florian Weimer * doc/invoke.texi (Warning Options): Document -Wstatic-local. c-family/ChangeLog: 2013-07-23 Florian Weimer * c.opt (Wstatic-local): Add option

Re: [C, C++] Implement -Wstatic-local

2013-07-23 Thread Florian Weimer
On 07/23/2013 09:51 PM, Andrew Pinski wrote: On Tue, Jul 23, 2013 at 12:48 PM, Florian Weimer wrote: We sometimes deal with code bases which use static local variables to cut down frame size, for compatibility with legacy targets. Obviously, this is bad for thread safety. This new warning

Re: [C, C++] Implement -Wstatic-local

2013-07-24 Thread Florian Weimer
think it's useful to have parity between the two front ends if possible. I think the C++ ABI mandates that the implementation adds implicit locks to enforce orderly initialization Yes, that's how we implement it. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH, vtv update] Fix /tmp directory issues in libvtv

2013-08-09 Thread Florian Weimer
levant autoconf checks are described here: <http://sourceware.org/glibc/wiki/Tips_and_Tricks/secure_getenv> -- Florian Weimer / Red Hat Product Security Team

Re: [C++ RFC / Patch] PR 54080, PR 52875 and more (aka SFINAE vs template recursion depth)

2013-08-09 Thread Florian Weimer
g question, but hopefully we can make all errors due to exceeded implementation limits hard errors, not subject to SFINAE. -- Florian Weimer / Red Hat Product Security Team

Re: [C++ RFC / Patch] PR 54080, PR 52875 and more (aka SFINAE vs template recursion depth)

2013-08-09 Thread Florian Weimer
behavior just be bugs? Depending on their error recovery implementation, not flagging infinite recursion as a hard error in SFINAE context could be an easy mistake to make. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH, vtv update] Fix /tmp directory issues in libvtv

2013-08-11 Thread Florian Weimer
ave the intended security effect. I wonder if we can simply label this functionality as unsafe for SUID/SGID programs, like we (hopefully) do for profiling. Also, logs_prefix should be declared const char *, then the cast can go away (I hope). -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH, vtv update] Fix /tmp directory issues in libvtv

2013-08-14 Thread Florian Weimer
uot;_%d" should probably be dropped because the argument is not a format string. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH, vtv update] Fix /tmp directory issues in libvtv

2013-08-19 Thread Florian Weimer
up in libvtv.so. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH, vtv update] Fix /tmp directory issues in libvtv

2013-08-19 Thread Florian Weimer
ep getenv". It should print a line containing "secure_getenv" or "__secure_getenv", but not plain "getenv". -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] C++ math constants

2013-03-01 Thread Florian Weimer
in() { return f() == 0; } -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] Vtable pointer verification (corruption/attach detection -- new feature

2013-03-26 Thread Florian Weimer
++ ABI, not the standard itself. -- Florian Weimer / Red Hat Product Security Team

Re: Comments on the suggestion to use infinite precision math for wide int.

2013-04-08 Thread Florian Weimer
hecking code.) Considering the range of different arithmetic operations we need to support, I'm not convinced that the ring model is appropriate. -- Florian Weimer / Red Hat Product Security Team

Re: Comments on the suggestion to use infinite precision math for wide int.

2013-04-09 Thread Florian Weimer
this a bit optimistic, considering that run-time overflow checking currently does not use existing hardware support? -- Florian Weimer / Red Hat Product Security Team

Re: Comments on the suggestion to use infinite precision math for wide int.

2013-04-09 Thread Florian Weimer
On 04/09/2013 02:41 PM, Robert Dewar wrote: On 4/9/2013 5:39 AM, Florian Weimer wrote: On 04/09/2013 01:47 AM, Robert Dewar wrote: Well the back end has all the information to figure this out I think! But anyway, for Ada, the current situation is just fine, and has the advantage that the

Re: [PATCH] Add a new option "-fstack-protector-strong"

2013-04-16 Thread Florian Weimer
- (E) the address from calling “alloca” Function F is said to be vulnerable if its frame address is exposed via (A) ~ (E). What about struct-returning functions? Internally, an address is passed to the called function. Would they trigger this? What about the this pointer in C++ code? -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] Add a new option "-fstack-protector-strong"

2013-04-17 Thread Florian Weimer
logic handling '-fstack-protector-strong'. * common.opt (fstack-protector-all): New option. Should be "fstack-protector-strong". -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH Ping v2] Extend -fstack-protector-strong to cover calls with return slot

2014-05-05 Thread Florian Weimer
On 02/03/2014 10:05 AM, Florian Weimer wrote: On 01/17/2014 11:26 AM, Florian Weimer wrote: On 01/08/2014 03:57 PM, Florian Weimer wrote: What about the attached version? It still does not exactly match your original suggestion because gimple_call_lhs (stmt) can be NULL_TREE if the result is

[PATCH] Provide inlining context in strict-overflow warnings

2014-05-13 Thread Florian Weimer
, is happening. More context is provided with -g than without, but I think this is acceptable. I bootstrapped and tested the attached patch on x86_64-redhat-linux-gnu, with no new regressions. -- Florian Weimer / Red Hat Product Security Team gcc/ 2014-05-13 Florian Weimer * fold-const.c

Re: [PATCH] Provide inlining context in strict-overflow warnings

2014-05-14 Thread Florian Weimer
On 05/14/2014 11:34 AM, Richard Biener wrote: On Tue, May 13, 2014 at 9:27 PM, Florian Weimer wrote: Patterns that trigger the optimization and warning can form after inlining, and it can be rather difficult to figure out what exactly is causing the warning. The inlining context at least

Re: [PATCH] Provide inlining context in strict-overflow warnings

2014-05-14 Thread Florian Weimer
On 05/14/2014 11:56 AM, Jakub Jelinek wrote: On Tue, May 13, 2014 at 09:27:08PM +0200, Florian Weimer wrote: Patterns that trigger the optimization and warning can form after inlining, and it can be rather difficult to figure out what exactly is causing the warning. The inlining context at

Re: Extend -fstack-protector-strong to cover calls with return slot

2014-01-17 Thread Florian Weimer
On 01/08/2014 03:57 PM, Florian Weimer wrote: What about the attached version? It still does not exactly match your original suggestion because gimple_call_lhs (stmt) can be NULL_TREE if the result is ignored and this case needs instrumentation, as you explained, so I use the function return

[PATCH Ping] Extend -fstack-protector-strong to cover calls with return slot

2014-02-03 Thread Florian Weimer
On 01/17/2014 11:26 AM, Florian Weimer wrote: On 01/08/2014 03:57 PM, Florian Weimer wrote: What about the attached version? It still does not exactly match your original suggestion because gimple_call_lhs (stmt) can be NULL_TREE if the result is ignored and this case needs instrumentation

Re: [RFA][PR 16361] Add warnings for NULL pointer dereferences and such

2014-02-04 Thread Florian Weimer
seems always true, including the call in tre-vrp.c:infer_value_range, so there's a minor cleanup opportunity. Looking at infer_nonnull_range, there's an undocumented interaction with -fdelete-null-pointer-checks. -- Florian Weimer / Red Hat Product Security Team

Re: Use "[warning enabled by default]" for default warnings

2014-02-11 Thread Florian Weimer
uot;. I don't think it's helpful. In my opinion, it is better to make this message obsolete by introducing the missing warning flags. -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] proposed fix for bug # 61144

2014-07-23 Thread Florian Weimer
p is 'true' for z::aaa. With the patch the reference to z::aaa is not folded, but its definition is not emitted either, so a undefined reference error is produced at link time. Technically, this is not a bug (for C++03 at least). But I do think folding the constant is an important o

Re: [PATCH 02/89] Introduce gimple_switch and use it in various places

2014-04-23 Thread Florian Weimer
s: <http://www.gnu.org/prep/standards/html_node/Formatting.html> -- Florian Weimer / Red Hat Product Security Team

Re: application/xml mime-type in recent libstdc++ doc changes

2012-12-11 Thread Florian Weimer
t prints "application/xml" even for text files. I fell into this trap as well, and have now filed a bug: https://bugzilla.redhat.com/show_bug.cgi?id=886005 -- Florian Weimer / Red Hat Product Security Team

Re: [RFC PATCH, i386]: Use %r15 for REAL_PIC_OFFSET_TABLE_REGNUM on x86_64

2012-12-27 Thread Florian Weimer
* Uros Bizjak: > +#elif defined(__x86_64__) > +#define __cpuid(level, a, b, c, d) \ > + __asm__ ("xchg{q}\t{%%}rbx, %q1\n\t" \ > +"cpuid\n\t" \ > +"xchg{q}\t{%%}rbx, %q1\n\t" \ > +: "

Re: [PATCH 1/2] Document HLE / RTM intrinsics

2013-01-27 Thread Florian Weimer
library uses them internally? (That would be quite a feat.) -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] Vtable pointer verification (corruption/attach detection -- new feature

2013-01-30 Thread Florian Weimer
ivial cost, it might make sense to revamp C++ virtual method dispatch altogether, addressing both security and modularity issues. (Yes, I understand these two paragraphs go off in entirely different directions. 8-) -- Florian Weimer / Red Hat Product Security Team

Re: [C++ PATCH] Introduce context struct for cxx_eval_constant_expression

2012-08-10 Thread Florian Weimer
On 07/31/2012 11:58 AM, Florian Weimer wrote: The attached patch adds a context parameter to cxx_eval_constant_expression and its subprograms. This way, we do not have to thread all context parameters manually. This will simplify the introduction of additional location information, as

Re: Fix PR c++/19351 (operator new[] overflow)

2012-08-10 Thread Florian Weimer
On 07/18/2012 04:31 PM, Florian Weimer wrote: On 07/18/2012 03:55 PM, Jason Merrill wrote: On 06/26/2012 10:29 AM, Florian Weimer wrote: + /* Set to (size_t)-1 if the size check fails. */ + if (size_check != NULL_TREE) +*size = fold_build3 (COND_EXPR, sizetype, size_check

Re: [C PATCH] -Wsizeof-pointer-memaccess warning

2012-08-17 Thread Florian Weimer
f them already lowered at this point? -- Florian Weimer / Red Hat Product Security Team

Re: [C PATCH] -Wsizeof-pointer-memaccess warning

2012-08-17 Thread Florian Weimer
e function, and the FEs only provide the last one right now. Could you pick the second argument for varargs functions? Incredibly hacky, but would do the trick for those two. Or does the FE not know at this point it is processing a varargs function? -- Florian Weimer / Red Hat Product Security Team

[RFC] Warning for potentially unbound writes to function parameters

2012-08-17 Thread Florian Weimer
to require optimization, alas). -- Florian Weimer / Red Hat Product Security Team commit 324c7189c9cf871584da988f12d1a686df0d6e0c Author: Florian Weimer Date: Fri Aug 17 18:19:13 2012 +0200 Implement -Wunbound-parameter-write (proof of concept) diff --git a/gcc/builtins.c b/gcc/builtins.c ind

Re: [RFC] Warning for potentially unbound writes to function parameters

2012-08-17 Thread Florian Weimer
PATH_MAX), but these have not fared well can turn out very difficult to use correctly over time (readdir_r being an example). -- Florian Weimer / Red Hat Product Security Team

[C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-08-21 Thread Florian Weimer
_64-redhat-linux-gnu. -- Florian Weimer / Red Hat Product Security Team 2012-08-21 Florian Weimer * libsupc++/vec.cc (compute_size): New function. (__cxa_vec_new2, __cxa_vec_new3): Use it. 2012-08-21 Florian Weimer * g++.old-deja/g++.abi/cxa_vec.C (test5, test6): New. diff --git a/gcc/t

[PATCH] PR other/54411: libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

2012-08-29 Thread Florian Weimer
use this function in GCC, therefore I want to commit this just to the trunk. 2012-08-29 Florian Weimer PR other/54411 * objalloc.h (objalloc_alloc): Always use the simple definition of the macro. 2012-08-29 Florian Weimer PR other/54411 * objalloc.c

Re: RFA: libiberty: cope with integer overflow in _objalloc_alloc

2012-08-31 Thread Florian Weimer
not suffer from this problem: <http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html> -- Florian Weimer / Red Hat Product Security Team

Re: Backtrace library [3/3]

2012-09-12 Thread Florian Weimer
equired path transformations (which are somewhat system-specific). -- Florian Weimer / Red Hat Product Security Team

Re: [PATCH] PR other/54411: libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

2012-09-17 Thread Florian Weimer
On 09/05/2012 07:31 AM, Ian Lance Taylor wrote: On Wed, Aug 29, 2012 at 10:32 AM, Florian Weimer wrote: This patches fixes an integer overflow in libiberty, which leads to crashes in binutils. The long version of the objalloc_alloc macro would have needed another conditional, so I removed

Re: [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-09-17 Thread Florian Weimer
On 08/21/2012 12:37 PM, Florian Weimer wrote: I don't think there are any callers out there, but let's fix this for completeness. A compiler emitting code to call this function would still have to perform overflow checks for the new T[n][m] case, so this interface is not as helpful a

Re: [C++ PATCH] Add overflow checking to __cxa_vec_new[23]

2012-09-17 Thread Florian Weimer
On 09/17/2012 12:15 PM, Paolo Carlini wrote: Hi, On 09/17/2012 11:51 AM, Florian Weimer wrote: On 08/21/2012 12:37 PM, Florian Weimer wrote: I don't think there are any callers out there, but let's fix this for completeness. A compiler emitting code to call this function would sti

[PATCH] Add missing include file in Makefile

2012-09-17 Thread Florian Weimer
The attached patch is required so that plug-ins can include gimple.h. I tested that cfg-flags.def is actually installed after this change. Okay for trunk? -- Florian Weimer / Red Hat Product Security Team 2012-09-17 Florian Weimer * Makefile.in (BASIC_BLOCK_H): Add cfg-flags.def. Index

Re: [PATCH] PR other/54411: libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

2012-09-18 Thread Florian Weimer
committed with these changes. -- Florian Weimer / Red Hat Product Security Team

[CPP] Add pragmas for emitting diagnostics

2012-09-25 Thread Florian Weimer
x86_64-redhat-linux-gnu, with no apparent regressions. Okay for trunk? -- Florian Weimer / Red Hat Product Security Team gcc/ChangeLog: 2012-09-25 Florian Weimer * doc/cpp.texi (Pragmas): Document #pragma GCC warning, #pragma GCC error. gcc/testsuite/ChangeLog: 2012-09-25 Florian Weimer

Re: [CPP] Add pragmas for emitting diagnostics

2012-09-27 Thread Florian Weimer
On 09/26/2012 10:19 PM, Tom Tromey wrote: "Florian" == Florian Weimer writes: Florian> This patch adds support for #pragma GCC warning and #pragma GCC Florian> error. These pragmas can be used from preprocessor macros, Florian> unlike the existing #warning and #error d

Fix PR c++/19351 (operator new[] overflow)

2012-06-14 Thread Florian Weimer
This is another attempt at ensuring that operator new[] always returns a block of sufficient size. This is on top of my previous patch rejecting VLA allocations: http://gcc.gnu.org/ml/gcc-patches/2012-06/msg00616.html Bootstrapped and tested on x86_64-linux-gnu. -- Florian Weimer / Red Hat

Re: [C++] Reject variably modified types in operator new

2012-06-25 Thread Florian Weimer
On 06/25/2012 05:25 AM, Jason Merrill wrote: On 06/11/2012 12:11 PM, Florian Weimer wrote: + tree inner_nelts_cst = maybe_constant_value (inner_nelts); + if (!TREE_CONSTANT (inner_nelts_cst)) + { + if (complain & tf_error) + error_at (EXPR_LOC_OR_HERE (inner_nelts), + "array size in

Re: Fix PR c++/19351 (operator new[] overflow)

2012-06-26 Thread Florian Weimer
On 06/14/2012 11:55 AM, Florian Weimer wrote: This is another attempt at ensuring that operator new[] always returns a block of sufficient size. This is on top of my previous patch rejecting VLA allocations: http://gcc.gnu.org/ml/gcc-patches/2012-06/msg00616.html I've committed the

Re: Fix PR c++/19351 (operator new[] overflow)

2012-07-17 Thread Florian Weimer
On 06/26/2012 04:29 PM, Florian Weimer wrote: Bootstrapped and tested on x86_86-unknown-linux-gnu, with no new regressions (this time including Java). Okay for trunk? Ping? -- Florian Weimer / Red Hat Product Security Team

Re: Fix PR c++/19351 (operator new[] overflow)

2012-07-18 Thread Florian Weimer
On 07/18/2012 03:55 PM, Jason Merrill wrote: On 06/26/2012 10:29 AM, Florian Weimer wrote: + /* Set to (size_t)-1 if the size check fails. */ + if (size_check != NULL_TREE) +*size = fold_build3 (COND_EXPR, sizetype, size_check, + original_size, TYPE_MAX_VALUE (sizetype

[C++ PATCH] Introduce context struct for cxx_eval_constant_expression

2012-07-31 Thread Florian Weimer
gcc-patches/2012-06/msg01596.html>. Bootstrapped and tested on x86_64-redhat-linux-gnu. -- Florian Weimer / Red Hat Product Security Team 2012-07-31 Florian Weimer * semantics.c (cxx_eval_builtin_function_call): Introduce const cxx_eval_constant_ctx * parameter. (cxx_bind_parameters_i

_FORTIFY_SOURCE for std::vector

2012-05-29 Thread Florian Weimer
-05-29 Florian Weimer * include/bits/stl_vector.h (vector::_M_fortify_range_check): New. * (vector::operator[]): Call it. * testsuite/23_containers/vector/element_access/2.cc: New. -- Florian Weimer / Red Hat Product Security Team Index: libstdc++-v3/include/bits

[C++] Reject variably modified types in operator new

2012-05-29 Thread Florian Weimer
-fpermissive? 2012-05-29 Florian Weimer * init.c (build_new): Reject variably modified types. 2012-05-29 Florian Weimer * g++.dg/init/new33.C: New. -- Florian Weimer / Red Hat Product Security Team Index: gcc/cp/init.c

Re: _FORTIFY_SOURCE for std::vector

2012-05-30 Thread Florian Weimer
ry mailing list. Will resubmit there. -- Florian Weimer / Red Hat Product Security Team

Re: [C++] Reject variably modified types in operator new

2012-05-30 Thread Florian Weimer
On 05/29/2012 06:41 PM, Gabriel Dos Reis wrote: On Tue, May 29, 2012 at 11:00 AM, Florian Weimer wrote: This patch flags operator new on variably modified types as an error. If this is acceptable, this will simplify the implementation of the C++11 requirement to throw std::bad_array_new_length

Re: [C++] Reject variably modified types in operator new

2012-06-01 Thread Florian Weimer
On 05/29/2012 06:00 PM, Florian Weimer wrote: This patch flags operator new on variably modified types as an error. If this is acceptable, this will simplify the implementation of the C++11 requirement to throw std::bad_array_new_length instead of allocating a memory region which is too short

_FORTIFY_SOURCE for std::vector

2012-06-01 Thread Florian Weimer
. _FORTIFY_SOURCE users expect some performance hit. In contrast to debugging mode, this does not change ABI and is more widely applicable. Okay for trunk? 2012-05-29 Florian Weimer * include/bits/stl_vector.h (vector::_M_fortify_range_check): New. * (vector::operator[]): Call it

Re: [C++] Reject variably modified types in operator new

2012-06-01 Thread Florian Weimer
On 06/01/2012 11:00 AM, Florian Weimer wrote: I'll try to warn about this case and make the transformation to the proper operator new[] call. Here's the version. I've added a warning for the ill-formed code. The only remaining glitch is in g++.dg/cpp0x/regress/debug-debug7.C

Re: _FORTIFY_SOURCE for std::vector

2012-06-01 Thread Florian Weimer
t copying literally what GNU libc is doing. I can change it to the shorter version if you want me to. -- Florian Weimer / Red Hat Product Security Team

Re: _FORTIFY_SOURCE for std::vector

2012-06-01 Thread Florian Weimer
st additional checks are implemented (reliance upon __builtin_object_size in particular), it will always be magic you cannot rely on, which makes good documentation difficult. But we should at least explain that! (Obviously, the std::vector check doesn't share this problem.) -- Floria

Re: _FORTIFY_SOURCE for std::vector

2012-06-01 Thread Florian Weimer
totyped in glibc headers, so you want probably in the checking method declare it in some __gnu* namespace as extern "C" __chk_fail () __attribute__((unused)); and then use. Good point, thanks. I'm asking the libc folks if we may use this symbol from libstdc++, just to be on the safe

Re: [C++] Reject variably modified types in operator new

2012-06-01 Thread Florian Weimer
On 06/01/2012 05:37 PM, Jason Merrill wrote: On 06/01/2012 08:09 AM, Florian Weimer wrote: The only remaining glitch is in g++.dg/cpp0x/regress/debug-debug7.C, specifically (b is not a constant): int (*x)[b] = new int[a][b]; // { dg-error "not usable" } The new warning I've

Re: [C++] Reject variably modified types in operator new

2012-06-01 Thread Florian Weimer
On 06/01/2012 06:19 PM, Jason Merrill wrote: On 06/01/2012 11:40 AM, Florian Weimer wrote: I'm puzzled why build_new is even invoked after detecting that there is a non-constant expression. I'd accept a patch to change that. I don't really now what I'm doing here. B

[Doc] Add caveat to __builtin_object_size

2012-06-04 Thread Florian Weimer
This patch adds a cross-reference to GNU libc and _FORTIFY_SOURCE (which needs to be documented there) and mentions the optimization level requirements. Okay for trunk? 2012-06-04 Florian Weimer * doc/extend.texi (Object Size Checking): Mention _FORTIFY_SOURCE, add caveat

Re: [Doc] Add caveat to __builtin_object_size

2012-06-04 Thread Florian Weimer
On 06/04/2012 10:23 AM, Jakub Jelinek wrote: On Mon, Jun 04, 2012 at 10:15:35AM +0200, Florian Weimer wrote: --- gcc/doc/extend.texi (revision 187951) +++ gcc/doc/extend.texi (working copy) @@ -7376,8 +7376,15 @@ @findex __builtin___vfprintf_chk GCC implements a limited buffer overflow

Re: [Doc] Add caveat to __builtin_object_size

2012-06-04 Thread Florian Weimer
On 06/04/2012 11:01 AM, Jakub Jelinek wrote: On Mon, Jun 04, 2012 at 10:34:21AM +0200, Florian Weimer wrote: +This protection mechanism is only a last resort. As a programmer, you +must not rely on its presence, but use explicit buffer length checks +to avoid buffer overflows. GCC may not be

Re: [Doc] Add caveat to __builtin_object_size

2012-06-04 Thread Florian Weimer
he problem is unsolvable in the general case. -- Florian Weimer / Red Hat Product Security Team

Re: [Doc] Add caveat to __builtin_object_size

2012-06-04 Thread Florian Weimer
On 06/04/2012 12:11 PM, Jakub Jelinek wrote: On Mon, Jun 04, 2012 at 11:59:59AM +0200, Florian Weimer wrote: What about this? +This protection mechanism is only a last resort. As a programmer, you +must not rely on its presence, but use explicit buffer length checks +to avoid buffer overflows

[C++] Return error_mark_node from cp_parser_constant_expression

2012-06-04 Thread Florian Weimer
and C++98 mode. This removes several spurious errors, and the testsuite is adjusted accordingly. Bootstrapped on x86_64-linux-gnu with C, C++, TLO enabled, "make check-c++" passes with no regressions. (Sorry if Thunderbird has garbled the changelog entries.) 2012-06-04 Flor

Re: _FORTIFY_SOURCE for std::vector

2012-06-04 Thread Florian Weimer
;m not sure the test case actually ran (if it did, it passed on first try, which would be unusual.) -- Florian Weimer / Red Hat Product Security Team Index: libstdc++-v3/include/bits/c++config === --- libstdc++-v3/include/bits/c++co

Re: _FORTIFY_SOURCE for std::vector

2012-06-04 Thread Florian Weimer
On 06/04/2012 09:07 PM, Marc Glisse wrote: On Mon, 4 Jun 2012, Florian Weimer wrote: void write(std::vector& blob, unsigned n, float v1, float v2, float v3, float v4) { blob[n] = v1; blob[n + 1] = v2; blob[n + 2] = v3; blob[n + 3] = v4; } Would be great if it ended up testing only n and

Re: [C++] Return error_mark_node from cp_parser_constant_expression

2012-06-04 Thread Florian Weimer
On 06/04/2012 08:40 PM, Jason Merrill wrote: On 06/04/2012 06:36 AM, Florian Weimer wrote: (Sorry if Thunderbird has garbled the changelog entries.) I add the ChangeLog to the top of the patch to avoid this. :) Good idea. - if (TREE_CODE (w) != INTEGER_CST) + if (w == error_mark_node

Re: [C++] Return error_mark_node from cp_parser_constant_expression

2012-06-05 Thread Florian Weimer
On 06/04/2012 10:46 PM, Jason Merrill wrote: On 06/04/2012 04:12 PM, Florian Weimer wrote: This doesn't make sense to me. parser->integral_constant_expression_p should always be true at this point if you're moving the restore later (which also seems unnecessary). I

Re: _FORTIFY_SOURCE for std::vector

2012-06-06 Thread Florian Weimer
but then we'd lose consistency.) I'm going to look for tool support for locating such uses of operator[]. We might start recommending developers to switch to the at() member functions in most code. -- Florian Weimer / Red Hat Product Security Team

Re: [C++] Reject variably modified types in operator new

2012-06-11 Thread Florian Weimer
On 06/01/2012 02:09 PM, Florian Weimer wrote: On 06/01/2012 11:00 AM, Florian Weimer wrote: I'll try to warn about this case and make the transformation to the proper operator new[] call. Here's the version. I've added a warning for the ill-formed code. The only remaining

Re: [PR19351, C++] Fix heap overflow in operator new[]

2011-05-29 Thread Florian Weimer
* Jason Merrill: > Sorry it's taken so long to review this. Same here. *sigh* Thanks for your comments. > On 02/21/2011 04:05 PM, Florian Weimer wrote: >> build_operator_new_call (tree fnname, VEC(tree,gc) **args, >> -tree *

<    1   2   3   4   5   6   >