一句话：提出差分测试框架 LookUB，发现 Clang 中 17 个消除 sanitizer 失败的优化，并挖出 20 个新 bug。
Sanitizer 通过运行时检查检测未定义行为及其漏洞，但常与优化 pass 同用，二者目标冲突：优化器会利用 UB 假设提升性能，可能删除 sanitizer 的失败报告，从而隐藏甚至引入缺陷。本文提出 LookUB，一个基于差分测试的框架，用于系统发现会消除 sanitizer 失败的优化器变换。作者用该方法在 Clang 中找到 17 个此类优化，并结合静态分析与 fuzzing 搜索此前被这些优化掩盖的 bug，在 Linux Containers、libmpeg2、NTFS-3G 和 WINE 中发现 20 个新 bug。最后提出定制 Clang 优化器的缓解策略，仅带来 4% 开销。
Sanitizers are widely used compiler features that detect undefined behavior and resulting vulnerabilities by injecting runtime checks into programs. For better performance, sanitizers are often used in conjunction with optimization passes. But doing so combines two compiler features with conflicting objectives. While sanitizers want to expose undefined behavior, optimizers often exploit these same properties for performance. In this paper, we show that this clash can have serious consequences: optimizations can remove sanitizer failures, thereby hiding the presence of bugs or even introducing new ones. We present LookUB, a differential-testing based framework for finding optimizer transformations that elide sanitizer failures. We used our method to find 17 such sanitizer-eliding optimizations in Clang. Next, we used static analysis and fuzzing to search for bugs in open-source projects that were previously hidden due to sanitizer-eliding optimizations. This led us to discover 20 new bugs in Linux Containers, libmpeg2, NTFS-3G, and WINE. Finally, we present an effective mitigation strategy based on a customization of the Clang optimizer with an overhead increase of 4%.
@article{paperbot1974,
title = {Don’t Look UB: Exposing Sanitizer-Eliding Compiler Optimizations},
author = {Raphael Isemann and Cristiano Giuffrida and Herbert Bos and Erik van der Kouwe and Klaus von Gleissenthall},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {PLDI},
year = {2023},
doi = {10.1145/3591257}
}