public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "agner at agner dot org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug c/49820] Explicit check for integer negative after abs optimized away Date: Wed, 27 Jul 2011 14:28:00 -0000 [thread overview] Message-ID: <bug-49820-4-IQQZ0WhBO6@http.gcc.gnu.org/bugzilla/> (raw) In-Reply-To: <bug-49820-4@http.gcc.gnu.org/bugzilla/> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49820 --- Comment #15 from Agner Fog <agner at agner dot org> 2011-07-27 14:27:33 UTC --- How do you define "clever things"? Checking that a variable is within the allowed range is certainly a standard thing that every SW teacher tells you to do. I think it is reasonable to expect -Wall to do what it says and set a very high warning level. Optimizing away an overflow check is such a dangerous thing to do that it requires a warning. I think it may be wise to distinguish between optimizing away a whole branch or loop, versus just making calculations more efficient, e.g. simplifying expressions or making induction variables. If a branch can be optimized away then it is either violating the intentions of the programmer or the program has a logical error. A warning would be in place in either case. What I am suggesting is that optimizing away a branch should give a warning at a lower level than simplifying an arithmetic expression. I know this might be somewhat complicated to implement, but it would be useful for catching the situation where an overflow check is optimized away. Checking for overflow in a "safe" way is so complicated and tedious that it is practically never done (see https://www.securecoding.cert.org/confluence/display/seccode/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow ) Sorry for being persistent, but I think this issue has serious security implications.
prev parent reply other threads:[~2011-07-27 14:28 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2011-07-23 7:11 [Bug c/49820] New: " agner at agner dot org 2011-07-23 7:20 ` [Bug c/49820] " schwab@linux-m68k.org 2011-07-23 17:23 ` pinskia at gcc dot gnu.org 2011-07-23 17:30 ` schwab@linux-m68k.org 2011-07-23 20:48 ` noloader at gmail dot com 2011-07-23 20:59 ` ebotcazou at gcc dot gnu.org 2011-07-23 22:28 ` noloader at gmail dot com 2011-07-24 8:10 ` ebotcazou at gcc dot gnu.org 2011-07-24 8:17 ` agner at agner dot org 2011-07-24 9:41 ` pinskia at gcc dot gnu.org 2011-07-25 7:44 ` agner at agner dot org 2011-07-25 7:46 ` ebotcazou at gcc dot gnu.org 2011-07-25 14:22 ` agner at agner dot org 2011-07-26 19:32 ` agner at agner dot org 2011-07-27 11:23 ` ebotcazou at gcc dot gnu.org 2011-07-27 14:28 ` agner at agner dot org [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-49820-4-IQQZ0WhBO6@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).