Undefined Behavior: Overview with Examples

Undefined Behavior: Overview with Examples

• 1.
  Undefined Behavior Overview withExamples Kangjun Heo December 3, 2019 ARGOS, Chungnam National University Kangjun Heo, Undefiend Behavior: Overview with Examples 1/16
• 2.
  Presenter • Kangjun Heo •17’ Computer Science and Engineering • Chugnam National University since 2019 • ARGOS since 2019 spring semester • knowledge@o.cnu.ac.kr / GitHub @0x00000FF Kangjun Heo, Undefiend Behavior: Overview with Examples 2/16
• 3.
  Undefined Behavior Every languagehas their specification. And also it describes actions for each rules. but... Kangjun Heo, Undefiend Behavior: Overview with Examples 3/16
• 4.
  Undefined Behavior Especially inC, C++... • Syntatically intact, compiled successfully. • However, some of actions are Undefined. • Thus, we cannot predict the actual action of the program. ⇒ Making the program meaningless Kangjun Heo, Undefiend Behavior: Overview with Examples 4/16
• 5.
  Signed Overflow What ifthe x is INT MAX...? bool foo (int x) { return x + 1 > x; // true? } Kangjun Heo, Undefiend Behavior: Overview with Examples 5/16
• 6.
  Signed Overflow Compiler ”may”compile this code to... foo(int): movl $1 , %eax // always true! ret We can predict the function can be false when the x is INT MAX. However, it’s UB because Signed Overflow is not defined! Kangjun Heo, Undefiend Behavior: Overview with Examples 6/16
• 7.
  String Literal Modification char*str = "4Rg0S"; str [2] = ’G’; // UB! This code is compiled to: .LC0: .string "4Rg0S" main: movb $71 , .LC0 +2(% rip) // SIGSEGV xorl %eax , %eax ret Kangjun Heo, Undefiend Behavior: Overview with Examples 7/16
• 8.
  String Literal Modification $objdump -s -j .rodata a.out a.out: file format elf -64-X86 -64 Contents of section .rodata: 2000 01000200 34526730 5300 ....4 Rg0S. data in section .rodata cannot be written, SIGSEGV occurs Fortunately, from C++ 11, string literal to char * is banned! Kangjun Heo, Undefiend Behavior: Overview with Examples 8/16
• 9.
  Pointer Operations Out ofbound indexing is also UB: int arr [4] = {0, 1, 2, 3}; int *p = arr + 5; // UB: out of bounds! Dereferencing Null Pointer is also UB: int *p = 0; // Null Pointer int a = *p; // UB: Dereferencing Null Kangjun Heo, Undefiend Behavior: Overview with Examples 9/16
• 10.
  Benefits? Since such behaviorsare not defined... • Compiler makers can implement in their way • Leads more optimizations Kangjun Heo, Undefiend Behavior: Overview with Examples 10/16
• 11.
  Benefits? int foo(unsigned charx) { int value = 2147483600; /* UB , but assuming 32 bit int */ value += x; if (value < 2147483600) bar(); return value; } Kangjun Heo, Undefiend Behavior: Overview with Examples 11/16
• 12.
  Benefits? This testing expressionalways assumed as false, if (value < 2147483600) bar(); So compiler regards the code as: int foo(unsigned char x) { int value = 2147483600; value += x; return value; } Kangjun Heo, Undefiend Behavior: Overview with Examples 12/16
• 13.
  However... Compilers are notdesigned to consider Undefined Behavior, Because it never happens! So You should conform language specification strictly. Kangjun Heo, Undefiend Behavior: Overview with Examples 13/16
• 14.
  Also... When you studyC... • Study with proper book! • Recommend: C Programming: A Modern Approach Kangjun Heo, Undefiend Behavior: Overview with Examples 14/16
• 15.
  Q & A? KangjunHeo, Undefiend Behavior: Overview with Examples 15/16
• 16.
  Thank You! Kangjun Heo,Undefiend Behavior: Overview with Examples 16/16