llsoftsecbook
llsoftsecbook copied to clipboard
Write section on undefined behaviour and the intersection of optimisation and security
We haven't so far discussed undefined behaviour in the book, how compilers use it for optimisation, and how that can lead to security issues.
It would also be interesting to talk more generally about the intersection of optimisation and security in compilers. For example, "The Correctness-Security Gap in Compiler Optimization" (https://ieeexplore.ieee.org/abstract/document/7163211) is an interesting reference. We could also discuss fully abstract compilation, or write about more practical matters like how to securely clear memory without the compiler optimising it away (we already have a TODO that relates to that).