Package: interchange Version: 5.7.7-2 Usertags: goto-cc During an analysis of all packages using our research compiler tool-chain (using tools from the cbmc package) the following error was found:
Upon invocation of die from here: http://sources.debian.net/src/interchange/5.7.7-2/dist/src/tlink.c?hl=203#L203 the C string will implicitly be cast to an integer, and the second (required) argument will be missing: http://sources.debian.net/src/interchange/5.7.7-2/dist/src/tlink.c?hl=105#L105 This will eventually cause a stack underflow with an arbitrary value being passed to printf, which may well be considered a security issue. (To be left to the maintainer to judge.) Best, Michael
pgpe98IgqcdrP.pgp
Description: PGP signature
