News for hackers. Stuff that matters.
Re:A public TrueCrypt Audit by Hello71 on Wednesday October 09, 2013 @10:20PM (#6525310)
This is likely a reference to the Debian OpenSSL fiasco.

http://www.debian.org/security/2008/dsa-1571

Re:A public TrueCrypt Audit by foobarbazqux on Wednesday October 09, 2013 @10:35PM (#6525357)
Oh I see. That is a lot of fiasco. I guess I'm mostly curious about a minimal example of useful code that a dead code eliminator will incorrectly optimize.
Re:A public TrueCrypt Audit by epsylon on Thursday October 10, 2013 @02:09AM (#6525945)
In the debian fiasco it's mostly a case of "manual code elimination" [1].

However there are plenty of examples of compilers aggressively removing code that causes undefined behaviour. Basically, when the compiler encounters UB, it can do whatever it wants to code that triggers the UB, which means possibly removing it. Compilers exploit this fact a lot because UBs happen a lot in "normal code". See here [2] for examples and explanations; I also can't help but mention John Regehr's blog [3] if you're interested in compilers, security, testing, safety.

[1] http://research.swtch.com/openssl

[2] http://blog.llvm.org/2011/05/what-every-c-programmer-should-...

[3] http://blog.regehr.org/archives/213 is a great article for example.

Re:A public TrueCrypt Audit by tedunangst on Thursday October 10, 2013 @02:03AM (#6525925)
That doesn't seem like a good fit. It wasn't a compiler problem, it wasn't dead code, and the problem wasn't skipping zeroing, it was too much zeroing!