3 ms·

> Undefined behavior is a problem for projects that are not testing certain conditions under certain compiler configurations. Like I said, undefined behaviour

> Undefined behavior is a problem for projects that are not testing certain conditions under certain compiler configurations. Like I said, undefined behaviour is a problem even for Chromium and the Linux kernel. We've seen that just be diligent isn't a solution. We're way past that now. > Every time you see these problems happening, the reason is that developers not only wrote incorrect (undefined) code, but also didn't test the code path that was affected. Technically true, but not insightful. Testing can never be exhaustive, so this observation doesn't light the way to a solution. > While I agree that a compiler should do a better job, ultimately the responsibility is on programmers This statement is true of the C language, but it isn't a solution, it's the problem-statement. It's not true of a language like Safe Rust, where the language itself closes the door on undefined behaviour, and where it is not the programmer's responsibility to avoid invoking undefined behaviour.

coliveira 6y ago
It is well known that undefined behavior are not the only bugs happening in codebases like Chromium and Linux. So pointing to these projects doesn't magically make the bug different from other categories of bugs that plague all kinds of projects, even in other languages. The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more.
- MaxBarraclough 6y ago
  > pointing to them doesn't magically make the bug different from other categories of bugs that plague all kinds of projects, even in other languages Undefined behaviour is responsible for a non-trivial fraction of the security vulnerabilities of C and C++ codebases. Undefined behaviour in an application can be entirely eliminated by writing the application in a safe language. That's the point. > The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more. Do you really think the Chromium team isn't aware of that flag in GCC and Clang? If there were an easy fix to the problem of accidental invocation of undefined behaviour, the problem would have gone away years ago. It's useful for a C/C++ compiler to offer to add runtime checks for a subset of the possible causes of undefined behaviour. We agree more projects should use such tools. As we're seeing, though, this isn't a silver bullet. Even extremely well-resourced and security-sensitive codebases end up with UB issues.
- Quekid5 6y ago
  The fact that X doesn't solve all security problems doesn't mean that X doesn't eliminate a whole class of problems. Memory safety problems are still a sizable proportion of the CVEs associated with C and C++ programs. > The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more. This is NOT a solution -- you cannot test every case. In fact, not even close: The possible state space to for signed addition of two 64-bit ints is 2^128. That is infeasible. A compiler for a 'safe' language CAN prove the absence of certain behaviors (UB being one of them).

coliveira 6y ago

It is well known that undefined behavior are not the only bugs happening in codebases like Chromium and Linux. So pointing to these projects doesn't magically make the bug different from other categories of bugs that plague all kinds of projects, even in other languages. The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more.

MaxBarraclough 6y ago
> pointing to them doesn't magically make the bug different from other categories of bugs that plague all kinds of projects, even in other languages Undefined behaviour is responsible for a non-trivial fraction of the security vulnerabilities of C and C++ codebases. Undefined behaviour in an application can be entirely eliminated by writing the application in a safe language. That's the point. > The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more. Do you really think the Chromium team isn't aware of that flag in GCC and Clang? If there were an easy fix to the problem of accidental invocation of undefined behaviour, the problem would have gone away years ago. It's useful for a C/C++ compiler to offer to add runtime checks for a subset of the possible causes of undefined behaviour. We agree more projects should use such tools. As we're seeing, though, this isn't a silver bullet. Even extremely well-resourced and security-sensitive codebases end up with UB issues.
Quekid5 6y ago
The fact that X doesn't solve all security problems doesn't mean that X doesn't eliminate a whole class of problems. Memory safety problems are still a sizable proportion of the CVEs associated with C and C++ programs. > The major compilers already have ways to test for undefined behavior such as -fsanitize=undefined. Projects need to use these flags and test more. This is NOT a solution -- you cannot test every case. In fact, not even close: The possible state space to for signed addition of two 64-bit ints is 2^128. That is infeasible. A compiler for a 'safe' language CAN prove the absence of certain behaviors (UB being one of them).