Date: Mon, 6 Jul 2015 18:17:34 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: How serious is undefined behavior? Hi, As most probably know clang and gcc have a feature called "undefined behavior sanitizer" which checks for stuff that according to the C standard is not defined. When you run this on real world software you'll find a lot of things. Most of it are signed integer overflows and invalid shift operations (shift exponent larger than type bit size, negative value, negative exponent). From a theoretic point of view the matter is clear: When something is undefined the compiler is allowed to create any kind of optimization that will cause all kinds of behavior and the programmer can't expect anything reliable to happen. However I wonder how practically relevant these issues are and also how much focus should be given to them. Do people have good examples where e.g. an invalid shift operation caused a real, severe security issue? Would people think it's a wise idea to put a lot of effort into testing applications with ubsan enabled and reporting all the bugs that pop up? (that would mean a lot of bugreports) Or would this be perceived as an annoying "that's a theoretical C language nitpick issue and not a real bug". (Just to give you an idea: This affects the very basic libraries, e.g. I recently reported a shiftleft issue in zlib  and openssl still exposes several issues just by running the testsuite with ubsan) Some practical notes: ubsan can be enabled with -fsanitize=undefined in CFLAGS and it's best to use a reasonably new version of it, e.g. clang 3.6 or gcc 5.1, they have a couple of new checks.  https://github.com/madler/zlib/commit/8a979f6c7986574e37316148cd8ca440c3bc08a3 -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.