undefined | Better HN

0 pointshannob6y ago0 comments

No, actually the false positive rate of these flags is practically zero. (I'm not sure if it's 100% zero, but I used those extensively, reported many bugs and every time a developer told me "this is a false positive" they were wrong.)

The reason they aren't enabled by default is that that's not what they're designed for. They have a significant performance impact, you can't enable them all at once, they conflict with other security features and they may introduce security issues.

These are developer features. They aren't there to run your production code, they are there to test during development and bug finding.

0 comments

9 comments · 3 top-level

saagarjha6y ago· 6 in thread

Here's one that I encountered that I cannot figure out:

  $ g++ -x c++ -fsanitize=undefined -
  #include <iostream>
  
  int main() {
      int *a = nullptr;
      std::cout << std::addressof(*a) << std::endl;
  }
  ^D
  $ ./a.out
  <stdin>:5:29: runtime error: reference binding to null pointer of type 'int'
  0

Karliss6y ago

You are not allowed to dereference a null pointer no matter how you use it even if you later convert it back to address.

hvdijk6y ago

You are allowed to dereference a null pointer, but you are not allowed to access the result or use it as an initialiser for a reference. You can only immediately discard the result, or immediately take the result's address. Using std::addressof(* a) first binds a reference, then uses that reference to take the address, hence the error. You won't get any UBSAN error with &*a.

1 more reply

edflsafoiewq6y ago

In C99 however, you are allowed to do &٭a because when the operand of & is the result of the unary ٭ operator

> neither that operator nor the & operator is evaluated and the result is as if both were omitted, except that the constraints on the operators still apply and the result is not an lvalue

1 more reply

cpdt6y ago

And to elaborate on how the error message relates to this: std::addressof takes a reference which also can’t be null. So when you dereference the pointer you’re actually turning it into a reference (or binding the reference to the pointer, as the error message says).

asveikau6y ago

A pretty common way to do the offset_of thing is to take a null pointers. Eg: &foo->member where foo is null.

sizeof on invalid pointer dereferences is also pretty common.

lallysingh6y ago

Doesn't addressof() take a reference?

favorited6y ago

I know TSan has zero false-positives, because it only flags a data race when multiple threads access the same memory without synchronization (and at least one of those accesses is a write). Not sure about the other LLVM sanitizers.

zamalek6y ago

> every time a developer told me "this is a false positive" they were wrong

This sounds like a good UB learning experience. The parent comments sounds like the author is running into UB more than they really want to.

j / k navigate · click thread line to collapse

0 comments

9 comments · 3 top-level

saagarjha6y ago· 6 in thread

Here's one that I encountered that I cannot figure out:

  $ g++ -x c++ -fsanitize=undefined -
  #include <iostream>
  
  int main() {
      int *a = nullptr;
      std::cout << std::addressof(*a) << std::endl;
  }
  ^D
  $ ./a.out
  <stdin>:5:29: runtime error: reference binding to null pointer of type 'int'
  0

Karliss6y ago

You are not allowed to dereference a null pointer no matter how you use it even if you later convert it back to address.

hvdijk6y ago

1 more reply

edflsafoiewq6y ago

In C99 however, you are allowed to do &٭a because when the operand of & is the result of the unary ٭ operator

> neither that operator nor the & operator is evaluated and the result is as if both were omitted, except that the constraints on the operators still apply and the result is not an lvalue

1 more reply

cpdt6y ago

asveikau6y ago

A pretty common way to do the offset_of thing is to take a null pointers. Eg: &foo->member where foo is null.

sizeof on invalid pointer dereferences is also pretty common.

lallysingh6y ago

Doesn't addressof() take a reference?

favorited6y ago

zamalek6y ago

> every time a developer told me "this is a false positive" they were wrong

This sounds like a good UB learning experience. The parent comments sounds like the author is running into UB more than they really want to.

j / k navigate · click thread line to collapse