PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Compiler bug causes compiler bug: how a 12-year-old g++ bug took down Solidity

osec.io | blog | #cpp | #compiler | #solidity | #gcc | #solc | #boost
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec explains how a 12-year-old G++ overload-resolution bug, C++20 comparison rewrites and legacy Boost code crash Solidity's compiler (solc) on valid code — and how to fix it.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Breaking the Solidity Compiler with a Fuzzer
A fuzzing campaign against the Solidity compiler solc surfaced nearly 20 new bugs, mostly unreported; the recipe combined source-code-style AFL mutations, corpus curation, and patience.
blog · osec.io
Solidity compilers: memory safety
OtterSec explores the Solidity compilation pipeline and YUL optimizer assumptions to explain what 'memory-safe' assembly actually guarantees — and where inline assembly breaks those guarantees.
blog · bughunters.google.com
LLVM's 'RFC: C++ Buffer Hardening' at Google
Google shares how it evaluated LLVM's proposed C++ buffer hardening approach, outlining initial conclusions, practical adoption tips, and the next steps planned in this hardening journey.
blog · blog.trailofbits.com
Sanitize your C++ containers: ASan annotations step-by-step
A step-by-step guide to ASan container annotations for detecting container-overflow bugs in C++ std::vector, std::string, and std::deque, plus Trail of Bits' contributions to libc++ and GCC.
blog · blog.trailofbits.com
Typos that omit security features and how to test for them
An audit found a typo that silently disabled _FORTIFY_SOURCE; the team found and fixed twenty similar C/C++ bugs on GitHub and shows how to test builds for this missed mitigation.
blog · blog.trailofbits.com
A Year in the Life of a Compiler Fuzzing Campaign
A year of fuzzing the Solidity compiler solc produced 74 reports with 67 confirmed bugs. This retrospective asks whether fuzzing campaigns saturate and why sustained efforts still pay off.
Back