TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Clang-11.0.0 Miscompiled SQLite

302 pointsby marcobambinialmost 5 years ago

11 comments

klysmalmost 5 years ago
If I understand correctly, everything is working as intended: a fuzzer caught a bug in an unreleased version of clang. The title makes it sound like somebody fucked up pretty badly.
评论 #23414333 未加载
评论 #23414585 未加载
评论 #23413106 未加载
评论 #23413896 未加载
评论 #23414108 未加载
评论 #23413152 未加载
mehrdadnalmost 5 years ago
Question for any low-level optimizing compiler engineers here: I obviously realize these are all important, but in your judgment, how much of making an error-free compiler would you say is about having a comprehensive test suite, vs. having <i>very</i> careful software engineers, vs. having extremely thorough code reviews, vs. something else? Put another way, if you were to lose one of these, which ones do you think would have the most&#x2F;least negative impact (or be the easiest&#x2F;hardest to make up for with other things) in terms of the correctness of the final product?
评论 #23413289 未加载
评论 #23412822 未加载
评论 #23413821 未加载
评论 #23413450 未加载
评论 #23413222 未加载
评论 #23418461 未加载
评论 #23413103 未加载
评论 #23414156 未加载
评论 #23415511 未加载
评论 #23419252 未加载
ridiculous_fishalmost 5 years ago
These sorts of bugs are more common than you may think! Here’s gcc miscompiling fish shell: <a href="https:&#x2F;&#x2F;github.com&#x2F;fish-shell&#x2F;fish-shell&#x2F;issues&#x2F;6962" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;fish-shell&#x2F;fish-shell&#x2F;issues&#x2F;6962</a>
评论 #23420590 未加载
评论 #23413546 未加载
mister_hnalmost 5 years ago
I don&#x27;t understand trying to use the trunk version of a under-development compiler. Would you use the binaries built from an unstable compiler in production?<p>Given that here we talk about SQLite, what&#x27;s the advantage to use clang 11 instead of a previous version?
评论 #23412954 未加载
评论 #23412966 未加载
评论 #23413475 未加载
评论 #23412929 未加载
评论 #23413155 未加载
评论 #23413499 未加载
评论 #23413706 未加载
评论 #23420878 未加载
评论 #23413981 未加载
adr_almost 5 years ago
Clang 11 hasn&#x27;t been released yet, right?
评论 #23412729 未加载
评论 #23412718 未加载
评论 #23412807 未加载
aidenn0almost 5 years ago
Given that it&#x27;s SQLite, this is likely a compiler bug. However, the code given is insufficient to demonstrate a compiler bug. Given:<p><pre><code> c = pMem-&gt;flags; sqlite3VdbeMemRelease(pMem); pMem-&gt;flags = MEM_Str|MEM_Term|(c&amp;(MEM_AffMask|MEM_Subtype)); </code></pre> You could have say:<p><pre><code> sqlite3VdbeMemRelease(struct foo pMem) { *(some_other_type *)&amp;pMem-&gt;flags = bar; } </code></pre> In which case the C aliasing rules would allow the compiler to assume that the assignment through &quot;some_other_type&quot; does not affect the assignment through whatever type pMem-&gt;flags is.<p>I have seen this bug happen before, when compilers got better at inlining, where it was something like<p><pre><code> void getAddressOfSomething(intptr_t *address); ... char *p; getAddressOfSomething((intptr_t *)&amp;p) *p=foo </code></pre> The compiler could reorder the \*p=foo line to be before the getAddressOfSomething call for the same reason.<p>TL;DR: Turn of strict aliasing via compiler flags (-fno-strict-aliasing on gcc) if you ever type-pun anywhere without using a union.
评论 #23412972 未加载
评论 #23412913 未加载
fctorialalmost 5 years ago
<p><pre><code> c = pMem-&gt;flags; sqlite3VdbeMemRelease(pMem); pMem-&gt;flags = MEM_Str|MEM_Term|(c&amp;(MEM_AffMask|MEM_Subtype)); </code></pre> &#x27;pMem-&gt;flags&#x27; is a u16[1]. Shouldn&#x27;t it be copied to &#x27;c&#x27;. How can &#x27;sqlite3VdbeMemRelease&#x27; alter the value of &#x27;c&#x27;.<p>[1]<a href="https:&#x2F;&#x2F;github.com&#x2F;smparkes&#x2F;sqlite&#x2F;blob&#x2F;8caf9219240123fbe6cff67b1e0da778c62d7621&#x2F;src&#x2F;vdbeInt.h#L148" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;smparkes&#x2F;sqlite&#x2F;blob&#x2F;8caf9219240123fbe6cf...</a>
评论 #23412881 未加载
评论 #23412890 未加载
评论 #23412888 未加载
评论 #23412915 未加载
评论 #23412824 未加载
eyegoralmost 5 years ago
Holy cow, this happened at -O1. This doesn&#x27;t seem like the sort of optimization that should be possible at such a low level. I&#x27;ve run into plenty of trouble with higher level optimization flags in compilers before, but this is wild.
pwaglandalmost 5 years ago
I see several references in this thread to &quot;a bug in Clang that is already fixed&quot;, but I can&#x27;t see anywhere where anyone references this bug.<p>Can anyone point to the bug report (and&#x2F;or fix) in Clang?
评论 #23418429 未加载
nurettinalmost 5 years ago
Why would OSFuzz send the bug report to SQLite instead of Clang?
评论 #23413903 未加载
hosejaalmost 5 years ago
So... if I&#x27;m understanding correctly, you&#x27;re accessing released memory? How is this anything but undefined behaviour?
评论 #23414684 未加载
评论 #23413462 未加载