How serious is undefined behavior?

[Hanno Böck <hanno () hboeck de>]

Hi,

As most probably know clang and gcc have a feature called "undefined
behavior sanitizer" which checks for stuff that according to the C
standard is not defined.

When you run this on real world software you'll find a lot of things.
Most of it are signed integer overflows and invalid shift operations
(shift exponent larger than type bit size, negative value, negative
exponent).

From a theoretic point of view the matter is clear: When something is
undefined the compiler is allowed to create any kind of optimization
that will cause all kinds of behavior and the programmer can't expect
anything reliable to happen.

However I wonder how practically relevant these issues are and also
how much focus should be given to them. Do people have good examples
where e.g. an invalid shift operation caused a real, severe security
issue?
Would people think it's a wise idea to put a lot of effort into testing
applications with ubsan enabled and reporting all the bugs that pop up?
(that would mean a lot of bugreports) Or would this be perceived as an
annoying "that's a theoretical C language nitpick issue and not a real
bug".

(Just to give you an idea: This affects the very basic libraries, e.g.
I recently reported a shiftleft issue in zlib [1] and openssl still
exposes several issues just by running the testsuite with ubsan)

Some practical notes: ubsan can be enabled with -fsanitize=undefined
in CFLAGS and it's best to use a reasonably new version of it, e.g.
clang 3.6 or gcc 5.1, they have a couple of new checks.


[1]
https://github.com/madler/zlib/commit/8a979f6c7986574e37316148cd8ca440c3bc08a3


-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: _bin
Description: OpenPGP digital signature