From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 70038 invoked by alias); 20 Jun 2017 08:21:18 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Received: (qmail 70019 invoked by uid 89); 20 Jun 2017 08:21:17 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy=Hx-languages-length:357, recall, meet X-HELO: smtp.eu.adacore.com Received: from mel.act-europe.fr (HELO smtp.eu.adacore.com) (194.98.77.210) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 20 Jun 2017 08:21:16 +0000 Received: from localhost (localhost [127.0.0.1]) by filtered-smtp.eu.adacore.com (Postfix) with ESMTP id C903681453; Tue, 20 Jun 2017 10:21:14 +0200 (CEST) Received: from smtp.eu.adacore.com ([127.0.0.1]) by localhost (smtp.eu.adacore.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fhlEjbL5IRTH; Tue, 20 Jun 2017 10:21:14 +0200 (CEST) Received: from polaris.localnet (bon31-6-88-161-99-133.fbx.proxad.net [88.161.99.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.eu.adacore.com (Postfix) with ESMTPSA id A08A18134D; Tue, 20 Jun 2017 10:21:14 +0200 (CEST) From: Eric Botcazou To: Richard Kenner Cc: gcc-patches@gcc.gnu.org, law@redhat.com Subject: Re: RFC: stack/heap collision vulnerability and mitigation with GCC Date: Tue, 20 Jun 2017 08:21:00 -0000 Message-ID: <1668482.ocPt5K0QLh@polaris> User-Agent: KMail/4.14.10 (Linux/3.16.7-53-desktop; KDE/4.14.9; x86_64; ; ) In-Reply-To: <20170619181200.50E0C33CA8@vlsi1.gnat.com> References: <20170619181200.50E0C33CA8@vlsi1.gnat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-SW-Source: 2017-06/txt/msg01403.txt.bz2 > Out of curiousity, does the old Alpha/VMS stack-checking API meet the > requirements? From what I recall, I think it does. No, it's the usual probe-first-and-then-allocate strategy and Jeff rejects it because of valgrind. I'd personally rather change valgrind but... -- Eric Botcazou