freebsd security - May 2017 - openssl-1.0.2l

Under FreeBSD 8 (with GCC 4.2.1):

cc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include  -fPIC -DOPENSSL_P
IC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -pthread -D_THREAD_SAFE -D_REENTRANT -
DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN -O3 -fomit-frame-pointer
-Wall -O2 -pipe -march=prescott -Werror -Qunused-arguments -fstack-protector -fn
o-strict-aliasing -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_A
SM_MONT -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DM
D5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -c ech_oss
l.c
cc: unrecognized option '-Qunused-arguments'
cc1: warnings being treated as errors
ech_ossl.c: In function 'ecdh_compute_key':
ech_ossl.c:119: warning: 'buflen' may be used uninitialized in this
function
*** Error code 1
Stop.
make[4]: stopped in /usr/ports/security/openssl/work/openssl-1.0.2l/crypto/ecdh


May be really "'buflen' may be used uninitialized"?

On 26 May 2017, at 22:30, Lena at lena.kiev.ua wrote:
> 
> Under FreeBSD 8 (with GCC 4.2.1):
> 
> cc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include  -fPIC
-DOPENSSL_P
> IC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -pthread -D_THREAD_SAFE
-D_REENTRANT -
> DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN -O3
-fomit-frame-pointer
> -Wall -O2 -pipe -march=prescott -Werror -Qunused-arguments
-fstack-protector -fn
> o-strict-aliasing -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2
-DOPENSSL_BN_A
> SM_MONT -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM
-DSHA512_ASM -DM
> D5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -c
ech_oss
> l.c
> cc: unrecognized option '-Qunused-arguments'
> cc1: warnings being treated as errors
> ech_ossl.c: In function 'ecdh_compute_key':
> ech_ossl.c:119: warning: 'buflen' may be used uninitialized in this
function
> *** Error code 1
> Stop.
> make[4]: stopped in
/usr/ports/security/openssl/work/openssl-1.0.2l/crypto/ecdh
> 
> 
> May be really "'buflen' may be used uninitialized"?
Maybe you are running a very old, unsupported version of FreeBSD?
Please upgrade and try again.

Also many, if not most, "may be uninitialized" warnings from gcc 4.2
are bogus.

-Dimitry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 194 bytes
Desc: Message signed with OpenPGP
URL:
<http://lists.freebsd.org/pipermail/freebsd-security/attachments/20170526/d3da8ba4/attachment.sig>