Don't Look UB: Exposing Sanitizer-Eliding Compiler Optimizations
summary
Differential-testing framework LookUB compiles programs with sanitizers on with and without optimization to expose optimizer transformations that remove sanitizer failures. Applied to Clang it finds 17 sanitizer-eliding optimizations, uses static analysis plus slow fuzzing on OSS-Fuzz and Juliet to locate real-world effects, and uncovers 20 new bugs in Linux Containers, libmpeg2, NTFS-3G, and WINE. Prototype mitigation customizes the Clang optimizer and increases runtime overhead by about 4%.
AI-written summary · about
chapters (11)
- 0:00Sanitizer-lighting optimizations
- 1:03What sanitizers do
- 2:48Sanitizers vs optimizers
- 3:49Testing interactions
- 5:55Why checks disappear
- 7:00How optimizers exploit undefined behavior
- 8:25Fixing vs exploiting bugs
- 9:30Real-world impact
- 10:5719 bugs found
- 11:17Incompatibility summary
- 11:58Q&A
related talks
19mExploiting Undefined Behavior in C/C++ Programs for Optimization: A Study on the(…)
59mBeyond Sanitizers...
01h 30mDangerous Optimizations in C and C++ Programming Languages
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++
01h 12mFinding Bugs with Clang at Compile and Run Time
49mUndefined Behavior in 2017 (part 1 of 2)
01h 02mSanitize your C++ code
18mExciting new compiler flags for kernel security