[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150706181734.2b0288ca@pc1>
Date: Mon, 6 Jul 2015 18:17:34 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: How serious is undefined behavior?
Hi,
As most probably know clang and gcc have a feature called "undefined
behavior sanitizer" which checks for stuff that according to the C
standard is not defined.
When you run this on real world software you'll find a lot of things.
Most of it are signed integer overflows and invalid shift operations
(shift exponent larger than type bit size, negative value, negative
exponent).
From a theoretic point of view the matter is clear: When something is
undefined the compiler is allowed to create any kind of optimization
that will cause all kinds of behavior and the programmer can't expect
anything reliable to happen.
However I wonder how practically relevant these issues are and also
how much focus should be given to them. Do people have good examples
where e.g. an invalid shift operation caused a real, severe security
issue?
Would people think it's a wise idea to put a lot of effort into testing
applications with ubsan enabled and reporting all the bugs that pop up?
(that would mean a lot of bugreports) Or would this be perceived as an
annoying "that's a theoretical C language nitpick issue and not a real
bug".
(Just to give you an idea: This affects the very basic libraries, e.g.
I recently reported a shiftleft issue in zlib [1] and openssl still
exposes several issues just by running the testsuite with ubsan)
Some practical notes: ubsan can be enabled with -fsanitize=undefined
in CFLAGS and it's best to use a reasonably new version of it, e.g.
clang 3.6 or gcc 5.1, they have a couple of new checks.
[1]
https://github.com/madler/zlib/commit/8a979f6c7986574e37316148cd8ca440c3bc08a3
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
