Tim Attwood wrote:
> The problem is that in C a null pointer is represented
> by 0,

Depends on the architecture, really, but in most cases, yes.

> but 0 is a valid memory address. So when you
> have a valid pointer to address 0, then the optimizer
> thinks you are checking for null, not for address 0.

The exploit was a bug in the kernel that dereferenced a pointer before 
checking for null, and the compiler silently optimized out the later check 
for null. If you can get the first dereference to work (by mapping some 
valid memory to the address associated with the null pointer value) then you 
skip over code people thought they wrote into their program and which the 
compiler removed.

> It does seem bad to me to have a so much bloat
> in the control switches for the GCC optimizer.

Tell me about it. Just wait till you have the fun of cross-compiling the 
compiler. :-)

-- 
   Darren New, San Diego CA, USA (PST)
   "We'd like you to back-port all the changes in 2.0
    back to version 1.0."
   "We've done that already. We call it 2.0."

Post a reply to this message