4 ms·

Have you never worked with or come across gcc or clang? Sounds quite a bit surprising to be honest. What implementation are you using? I use the following safe

Have you never worked with or come across gcc or clang? Sounds quite a bit surprising to be honest. What implementation are you using? I use the following safety arguments in gcc 6.2.1: -fsanitize=undefined -fsanitize=address -fno-omit-frame-pointer -D_FORTIFY_SOURCE=1 I am also aware of https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html, http://www.seclab.cs.sunysb.edu/mscc/ http://www.seclab.cs.sunysb.edu/mscc/, http://compcert.inria.fr/compcert-C.html http://compcert.inria.fr/compcert-C.html and http://pages.cs.wisc.edu/~austin/scc.html http://pages.cs.wisc.edu/~austin/scc.html

steveklabnik 10y ago
Ah, you're counting sanitizers here. I mean the core language itself. gcc, without those flags, will happily compile and run that C code without any complaints at all. (I have 4.8 locally, it does not understand the "undefined" one, but the address one seems to infinite loop? which is very strange.) That doesn't mean that I think static analysis tooling is bad, or invalid or something! (I forgot about CompCert, but I've never run across any of the other ones in the wild.)
pjmlp 10y ago
Sanitizers aren't part of ANSI C. Besides, gcc and clang are just two of many C compilers. https://en.wikipedia.org/wiki/List_of_compilers#C_compilers https://en.wikipedia.org/wiki/List_of_compilers#C_compilers
- snakeanus 10y ago
  > Sanitizers aren't part of ANSI C. Nobody claimed that they were. I only mentioned that there are C implementations that protect against these kinds of things in the runtime and that the standard does not force the implementation to not do any checks. > Besides, gcc and clang are just two of many C compilers. The reason that I mentioned them was because they are two most popular ones.
  - pjmlp 10y ago
    They aren't usable when writing portable code, if the target system doesn't have them, specially in the embedded space.
dbaupp 10y ago
My understanding is that sanitizers are generally not designed to be deployed in production software, they're written with catching problems in testing in mind (i.e. calling them an implementation of C seems dubious to me), and have problems resulting from that[0]. That said, I'd guess this is changing given how tempting it is to use these tools as a hardening mechanism. Also, unless you're talking specifically about CompCert's interpreter, I don't think CompCert does what you think it does. The compiler is a verified implementation of the standard, but that, by definition, doesn't say anything about how it handles undefined behaviour. [0]: http://seclists.org/oss-sec/2016/q1/363 http://seclists.org/oss-sec/2016/q1/363

steveklabnik 10y ago

Ah, you're counting sanitizers here. I mean the core language itself. gcc, without those flags, will happily compile and run that C code without any complaints at all. (I have 4.8 locally, it does not understand the "undefined" one, but the address one seems to infinite loop? which is very strange.) That doesn't mean that I think static analysis tooling is bad, or invalid or something! (I forgot about CompCert, but I've never run across any of the other ones in the wild.)

pjmlp 10y ago

Sanitizers aren't part of ANSI C. Besides, gcc and clang are just two of many C compilers. https://en.wikipedia.org/wiki/List_of_compilers#C_compilers https://en.wikipedia.org/wiki/List_of_compilers#C_compilers

snakeanus 10y ago
> Sanitizers aren't part of ANSI C. Nobody claimed that they were. I only mentioned that there are C implementations that protect against these kinds of things in the runtime and that the standard does not force the implementation to not do any checks. > Besides, gcc and clang are just two of many C compilers. The reason that I mentioned them was because they are two most popular ones.
- pjmlp 10y ago
  They aren't usable when writing portable code, if the target system doesn't have them, specially in the embedded space.

dbaupp 10y ago

My understanding is that sanitizers are generally not designed to be deployed in production software, they're written with catching problems in testing in mind (i.e. calling them an implementation of C seems dubious to me), and have problems resulting from that[0]. That said, I'd guess this is changing given how tempting it is to use these tools as a hardening mechanism. Also, unless you're talking specifically about CompCert's interpreter, I don't think CompCert does what you think it does. The compiler is a verified implementation of the standard, but that, by definition, doesn't say anything about how it handles undefined behaviour. [0]: http://seclists.org/oss-sec/2016/q1/363 http://seclists.org/oss-sec/2016/q1/363