4 ms·

"What's burned projects many more times and most worth worrying about are security-related compiler errors. They transform your code in a way that removes safet

"What's burned projects many more times and most worth worrying about are security-related compiler errors. They transform your code in a way that removes safety/security checks or adds a security problem (eg timing channel)." I'm not sure if the removal of safety or security checks were caused by compiler correctness issues rather than misunderstanding of language semantics / memory model of a programming language. If we take removal of a memset (to erase sensitive data) or of erroneous integer overflow checks (because of relying on undefined behavior) as an example, they are based on language / programmer error than compiler errors. These issues should be fixed at the language level so that first, a programmer can express his intentions more easily and second, that it is hard to write code which doesn't align with the programmers intention.

nickpsecurity 7y ago
Yeah, most of them were tied to undefined behavior. Example with detection method: https://pdos.csail.mit.edu/papers/stack:sosp13.pdf https://pdos.csail.mit.edu/papers/stack:sosp13.pdf One of the main ones that can do it without undefined behavior, or at least what I was told was undefined behavior, is optimizations getting rid of "dead" code. It doesn't have to be using memset: just an assignment. That assignment would sometimes get removed because the compiler thought nothing would be done with the assigned data. I never read if that was in C specification since it seemed to be a common problem in optimizations. Here's a recent solution just in case you find it interesting: https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-yang.pdf https://www.usenix.org/system/files/conference/usenixsecurit... "These issues should be fixed at the language level so that first, a programmer can express his intentions more easily and second, that it is hard to write code which doesn't align with the programmers intention." Being a fan of Ada, SPARK, and Rust, I can't agree with you more. The problem is legacy code, esp useful FOSS, that isn't getting ported any time soon. The OS's, web browsers, and media players come to mind. We need ways to analyze, test, and compile them that mitigate risks. Hence, all these projects targeting things like C.

nickpsecurity 7y ago

Yeah, most of them were tied to undefined behavior. Example with detection method: https://pdos.csail.mit.edu/papers/stack:sosp13.pdf https://pdos.csail.mit.edu/papers/stack:sosp13.pdf One of the main ones that can do it without undefined behavior, or at least what I was told was undefined behavior, is optimizations getting rid of "dead" code. It doesn't have to be using memset: just an assignment. That assignment would sometimes get removed because the compiler thought nothing would be done with the assigned data. I never read if that was in C specification since it seemed to be a common problem in optimizations. Here's a recent solution just in case you find it interesting: https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-yang.pdf https://www.usenix.org/system/files/conference/usenixsecurit... "These issues should be fixed at the language level so that first, a programmer can express his intentions more easily and second, that it is hard to write code which doesn't align with the programmers intention." Being a fan of Ada, SPARK, and Rust, I can't agree with you more. The problem is legacy code, esp useful FOSS, that isn't getting ported any time soon. The OS's, web browsers, and media players come to mind. We need ways to analyze, test, and compile them that mitigate risks. Hence, all these projects targeting things like C.