CVE-2006-1902 fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_...
LowCVSS 2.1
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.NOTE: the vendor states that the essence of the issue is "not correctly interpreting an offset to a pointer as a signed value."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU gcc | = 4.1 | No fix listed |
References
- bugs.debian.org
- gcc.gnu.org
- [gcc-bugs] 20060417 [Bug c/27180] New: pointer arithmetic overflow handling broken mailing-list
- [gcc-bugs] 20060417 [Bug middle-end/27180] New: pointer arithmetic overflow handling broken mailing-list
- gcc.gnu.org
- 20060417 gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- 20060418 RE: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- 20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list
- 20060418 Re: gcc 4.1 bug miscompiles pointer range checks, may place you at risk mailing-list