3 ms·
Where clang now clearly leads is in terms of runtime security and debugging features. Both share asan (address sanitizer), ubsan (undefined behavior) and tsan (
by hannob 10y ago
Where clang now clearly leads is in terms of runtime security and debugging features. Both share asan (address sanitizer), ubsan (undefined behavior) and tsan (threads). But msan (memory sanitizer, finds uninitialized memory use) is only available in clang.
In terms of exploit mitigation clang now has control flow integrity and safestack, as far as I'm aware nothing like this is available in gcc.
msan may not be such a big deal, because you could use clang for testing and gcc for production. But I hope more people adopt stronger exploit mitigations like CFI, and if gcc doesn't deliver them clang will win - at least for security sensitive areas.
- nn3 10y agogcc has ubsan too, and various stack overflow checking mechanisms.
- loeg 10y agoMy understanding (and empirical anecdote) is that Clang produces inferior debuginfo (eliding some locals' contents, even when their values are not actually lost) that makes it more difficult to debug than binaries produced by GCC. asan, ubsan, tsan, and msan are important debugging features, but for my every day use in core analysis, local variables in gdb are very important.