4 ms·

This? http://blog.regehr.org/archives/970 http://blog.regehr.org/archives/970 The compiler didn't create a security bug by removing the null check. The bug was

by E6300 10y ago

This? http://blog.regehr.org/archives/970 http://blog.regehr.org/archives/970 The compiler didn't create a security bug by removing the null check. The bug was created by the programmer when he didn't check for null before dereferencing the pointer. Even with the check, the program contained a bug.

vyodaiken 10y ago
The compiler converted a buggy program that was prevented from opening a security hole by defense in depth into a program with a security hole. It transformed a careless error into a systemic error, all in the cause of a micro-optimization that didn't.
- E6300 10y ago
  What are you talking about? Dereferencing invalid memory is a security bug.
  - vyodaiken 10y ago
    Not necessarily.
    - E6300 10y ago
      In what cases it's not?
      - vyodaiken 10y ago
        In the referenced case the introduced error involved a reference to a null pointer but there was still no exploitable security hole. The exploit was enabled when the compiler removed an explicit check. The null dereference was an error, but it was not a security issue on its own.
        E6300 10y ago
        Why didn't the kernel panic when it tried to access NULL?
        vyodaiken 10y ago
        Why is a compiler writer attempting to legislate the kernel address space?
        E6300 10y ago
        Give me a break. The kernel developers know C. They know what "undefined behavior" means.