CVEvulnerability

CVE-2008-1685

6.8 MEDIUM Published 2008-04-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-04-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119, CWE-189

Description

gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)

Affected configurations

• gnu gcc 4.2.0 • gnu gcc 4.2.1 • gnu gcc 4.2.2 • gnu gcc 4.2.3 • gnu gcc 4.2.4 • gnu gcc 4.3.0

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

Referenced by CWE · observed example (2)

  • CWE-1038 Insecure Automated Optimizations weakness
  • CWE-733 Compiler Optimization Removal or Modification of Security-critical Code weakness

References