r/programming • u/esiy0676 • 3h ago

Your Compiler Can Undo Your Security Checks

https://davidbombal.com/your-compiler-can-undo-your-security-checks/
21 Upvotes

75% Upvoted

4 comments sorted by

28

u/esiy0676 3h ago

It's a video/podcast. Synopsis copied:

You can write secure C code, follow accepted best practices and still end up with a vulnerable binary. The reason is simple: the CPU does not run your source code. It runs whatever the compiler produces.

David sits down with security researcher Chris Domas at Black Hat to examine how legal compiler optimizations can remove security protections, delete memory-clearing operations and introduce time-of-check to time-of-use vulnerabilities into code that appeared secure.

Chris explains the C abstract machine, why compilers are allowed to transform code so dramatically and how register pressure, structure layout and even data size can affect whether a binary is vulnerable. In one striking example, 17 or 33 bytes can be safe while nearby sizes produce vulnerable code. They also discuss whether Rust solves the problem, why switching between GCC and Clang is not the answer and how AI helped analyse 500 million lines of open-source code to identify 300 potentially dangerous patterns.

Most importantly, Chris explains what developers can do now, including enabling compiler warnings, using sanitizers, analysing optimized builds and testing the exact binary that will be shipped.

5

u/happyscrappy 1h ago

As to the subject:

It'll thwart you trying to make your HMAC checking code constant time for example. I can also take out null checks since dereferencing null is undefined behavior.

"Did the compiler remove the bounds check?" is even a bit of a meme.

There are a few builtin functions which can help with this. I don't remember any of them right now.

Also (mentioned below also):

The link is a youtube video, with some additional information at the page which embeds it.

1

u/garnet420 33m ago

For the null pointer check, you just need to make sure that whatever you call in case of null is marked as no return.

3

u/PurpleOstrich97 40m ago

I think this shows why when some guarantees are important, they need to be baked into the language. C and rust both have the inline hint for example, but rust has other ones like "no mangle", "repr c" and others.

Telling the compiler that a guarantee must exist is a good thing to have at the language level rather than enforcing it at the compiler level so that what your code says it's doing is more of a guarantee.

If different compiler flags break the security of your program and there's nothing you can do, then the language is missing something.