1 |
On Tue, Sep 28, 2010 at 2:43 AM, Diego Elio Pettenò <flameeyes@×××××.com> wrote: |
2 |
> Hi all, |
3 |
> |
4 |
> since the last time I asked Zac about this it came back to bite me[1] |
5 |
> this time I'm going to send the announce to the list first, and if |
6 |
> nobody can actually come up with a good reason not to, I'm going to ask |
7 |
> Zac tomorrow to re-enable the feature. |
8 |
> |
9 |
> What is this about? Portage already reports some of the overflow |
10 |
> warnings coming from the glibc fortified sources (-D_FORTIFY_SOURCE=2 |
11 |
> -O2 — enabled since gcc 4.3.3-r1 and even stronger with gcc 4.5 and |
12 |
> glibc 2.12+, afaict), but they really are divided into two categories: |
13 |
> |
14 |
> - might overflow (depends on combination of parameters and variables the |
15 |
> compiler can't completely untangle); |
16 |
> - _will_ overflow (whenever that code path is hit, an overflow will |
17 |
> happen). |
18 |
> |
19 |
> The former we should highlight but not die upon; the latter, though... |
20 |
> |
21 |
> As Mike and me expressed on the linked bug, code that is built with that |
22 |
> warning is code that is going to crash as surely as |
23 |
> |
24 |
> char *foo = NULL; |
25 |
> foo[3] = 'a'; |
26 |
> |
27 |
> which could result in nasty surprises for users (see [2] for the whole |
28 |
> reasoning). |
29 |
> |
30 |
> Now, we've not seen "proper" false positives (in the Portage sense I |
31 |
> mean — because even if the C library hits a false positive, it _will_ |
32 |
> crash with an abort() from its own code!), but Kumba pointed me at a |
33 |
> case that wasn't entirely clear, and took a bit of detective work to |
34 |
> track down [3] so you could have users report issues you cannot easily |
35 |
> identify or reproduce. I cannot make promises, but if all else fail I'll |
36 |
> see to be around to help you with those cases. |
37 |
> |
38 |
> So if you want to have your say, gentoo-qa is there for that. |
39 |
|
40 |
So do you expect: |
41 |
|
42 |
1. Developers to fix these bugs? |
43 |
2. Report them upstream? |
44 |
3. Remove packages? |
45 |
|
46 |
Its not clear to me what your purpose is. It is likely that many |
47 |
developers will be unable to do 1. Does that concern you? Should |
48 |
developers ask QA for help on packages? |
49 |
|
50 |
-A |
51 |
|
52 |
> |
53 |
> Thank you, |
54 |
> |
55 |
> [1] https://bugs.gentoo.org/show_bug.cgi?id=337031 |
56 |
> [2] |
57 |
> http://blog.flameeyes.eu/2010/09/14/not-all-failures-are-caused-equal |
58 |
> [3] |
59 |
> http://blog.flameeyes.eu/2010/09/12/some-_fortify_source-far-fetched-warnings-are-funny |
60 |
> |
61 |
> -- |
62 |
> Diego Elio Pettenò — “Flameeyes” |
63 |
> http://blog.flameeyes.eu/ |
64 |
> |
65 |
> If you found a .asc file in this mail and know not what it is, |
66 |
> it's a GnuPG digital signature: http://www.gnupg.org/ |
67 |
> |
68 |
> |
69 |
> |
70 |
> |