<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Sep 18, 2014, at 4:31 PM, jahanian <<a href="mailto:fjahanian@apple.com">fjahanian@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;"><div style="word-wrap:break-word"><div><span class=""><div><br></div></span>I am not sure what you mean. memcpy does not do any checking for overflow. You may do the checking for overflow before calling</div><div>memcpy yourself (essentially do what __builtin_memcpy_chk does).</div></div></blockquote></div><br></div><div class="gmail_extra">But it's detectable at compile time, right? Consider this, slightly changed from your tests:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_extra"> static char buf[10];</div><div class="gmail_extra"> memcpy(&buf[6], in, 5);<br></div><div class="gmail_extra"><br>Is there any reason this shouldn't say "memcpy <font face="arial, sans-serif" size="2">will always overflow destination buffer”?</font></div></div></div>
</blockquote></div><div><br></div><div>On the surface there is no reason. But manage does not disallow this and there will be applications which probably take advantage of this relaxation.</div></div></blockquote><div><br></div>Btw, on second thought, this might be a worthwhile feature for those who do not redefine memcpy to their __builtin_memcpy_chk siblings (provided it is</div><div>placed under its own security warning flag). It might be worth a bugzilla report.</div><div><br></div><div>- Thanks, Fariborz</div><div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><br></div><div>- fariborz</div><div><br></div><br></div>_______________________________________________<br>cfe-commits mailing list<br><a href="mailto:cfe-commits@cs.uiuc.edu">cfe-commits@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits<br></blockquote></div><br></body></html>