Originally posted by: H0W2_tomasz_lacki
Who is the owner of the application? Do you have source code and are you able to compile it or the binary form is available only?
What is the AIX lowest version the application supports?
Does the application links to any library from the AIX Toolbox?
Q:
For some reasons is it better to work with the package gcc-4 version or to work with gcc-8 version ?
A:
The short answer is compiling with GCC 8.
1) As mentioned before the GCC 8 is (will be) the default version for AIX Toolbox. Notice the link to AIX Toolbox default GCC runtime points to version that is not compatible with your application.
AIX72:/opt/freeware/lib> ls -l | grep gcc
drwxr-xr-x 3 root system 256 Nov 14 11:28 gcc
lrwxrwxrwx 1 root system 44 Dec 12 11:19 libatomic.a -> gcc/powerpc-ibm-aix7.2.0.0/8.3.0/libatomic.a
lrwxrwxrwx 1 root system 43 Dec 12 11:19 libgcc_s.a -> gcc/powerpc-ibm-aix7.2.0.0/8.3.0/libgcc_s.a
lrwxrwxrwx 1 root system 42 Dec 12 11:19 libgomp.a -> gcc/powerpc-ibm-aix7.2.0.0/8.3.0/libgomp.a
lrwxrwxrwx 1 root system 44 Dec 12 11:19 libstdc++.a -> gcc/powerpc-ibm-aix7.2.0.0/8.3.0/libstdc++.a
2) The GCC8 compared to GCC4 has much better diagnostic and it is more strict. Use -Wall during compilation. Review compiler output.
Read:.
https://developers.redhat.com/blog/2018/05/24/detecting-string-truncation-with-gcc-8/
You application shall run the same compiled by both GCC versions. Your issue is selecting the correct runtime library as they are not compatible when the C++ compiler is used.
Q:
Do these two gcc versions have different features ? I mean for some reasons our application would have to be build with the gcc-4 compiler.
A:
You could think of the GCC 4.8 as a subset of higher GCC version as the features are discussed. Read GCC release notes for more info. The correct C++ code compiled by GCC 4.8 shall compile on higher version as well.
Q:
Could we have a dependencie between our application and a gcc compiler version ?
A:
Some vendors guarantee binary compatibility between binaries produced by different GCC versions the vendor provides (e.g on the Linux distribution IBM recently purchased).
Q:
For security reasons or reliability reasons should we always work with the newest gcc compiler ?
A:
Both GCC 4.8 and GCC 8.3 are reliable compilers. They are used as system compilers for the RedHat Linux (7.7, 8.1). The RedHat Linux has the POWER processor version as well.
It is hard to say how it is popular in the AIX world where the xlC dominates. Especially for the C++ code. Maybe IBM could provide more info.
My experience for business type application with >1000000 lines of C++ code (AIX7.1 GCC6.3 -mcpu=power7 -O2 -pthread): No single issue related to compiler generated code.
The security affects output from the compiler not the compiler itself. The GCC runtime libraries needs to be deployed on the target system only (libgcc*aix*.ppc.rpm, libstdcplusplus*aix*.ppc.rpm).
The followed site shows that vulnerabilities historically affected GCC so far
https://www.cvedetails.com/product/960/GNU-GCC.html?vendor_id=72
Source code of the application is potential source of security issue. If it safe, compiler produces safe code.
The new version of the GCC could help you with that. The better diagnostic was already mentioned.
The other option you could consider is instrumenting the output code to be more secure if your application is compiled on the Linux. E.g. Let QA retest the application on Linux build with compiler flag -fstack-protector-strong that is not provided by AIX GCC. Fixing any issue found on one platform help other if the same code is used.
Read:
https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-gcc/
#AIXOpenSource#AIX-Open-Source-Software