found bugs in GCC

found bugs in GCC

[Rosu, Grigore]

Hi, I am a professor of CS at the University of Illinois at Urbana-Champaign.  In my group at the university as well as in my startup (runtimeverification.com) we have developed an ISO C11 compliant formal semantics, which we are using to analyze C programs.  In our efforts, we have found several bugs in C compilers, including in gcc.  If you are interested in us reporting them, then can you please provide dwight.guth@runtimeverification.com with an account?  Otherwise we will report the bugs on our blog, noting that cyberattackers then may exploit them.

Best,
Grigore

Re: found bugs in GCC

[Frank Ch. Eigler]

Hi -


> [...] In our efforts, we have found several bugs in C compilers,
> including in gcc.  If you are interested in us reporting them, then
> can you please provide dwight.guth@runtimeverification.com with an
> account?

OK.

> Otherwise we will report the bugs on our blog, noting that
> cyberattackers then may exploit them.

That aspect carries no persuasion.  The gcc bug tracker, like
apprx. all other gcc communication channels, are public.  I'm not sure
there exist an security-embargo-capable mailing list for the gcc
project.


- FChE

RE: found bugs in GCC

[Rosu, Grigore]

Obviously, gcc and other compilers are free to do whatever they want with undefined programs, but if a program is well-defined and gcc perceives it as undefined, then there is a small chance that it may optimize it in a way that it misbehaves or makes it vulnerable to attacks.  Since we have a formal semantics of C, which is executable, we should not report any undefined programs as bugs (I know from my colleague John Regehr from Utah that you guys (rightfully) do not like it when people report undefined programs as bugs).

All I wanted was to make sure that we get accounts, because Dwight's previous request was rejected as spam.

Thanks for the accounts,
Grigore



________________________________________
From: Frank Ch. Eigler [fche@redhat.com]
Sent: Tuesday, October 11, 2016 10:48 AM
To: Rosu, Grigore
Cc: overseers@gcc.gnu.org; dwight.guth@runtimeverification.com
Subject: Re: found bugs in GCC

Hi -


> [...] In our efforts, we have found several bugs in C compilers,
> including in gcc.  If you are interested in us reporting them, then
> can you please provide dwight.guth@runtimeverification.com with an
> account?

OK.

> Otherwise we will report the bugs on our blog, noting that
> cyberattackers then may exploit them.

That aspect carries no persuasion.  The gcc bug tracker, like
apprx. all other gcc communication channels, are public.  I'm not sure
there exist an security-embargo-capable mailing list for the gcc
project.


- FChE