anthropics / anthropics/claudes-c-compiler

[SECURITY] CCC ignores per‑field __attribute__((packed)), causing ABI/layout mismatch and memory corruption

Aperta
#203 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Rust
Stelle
2.8k
Fork
247
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

CCC does not honor per‑field __attribute__((packed)), producing incorrect alignment and layout. This breaks ABI compatibility with GCC/Clang and causes real out‑of‑bounds writes across translation units.

Minimal Example

```cpp
struct S { long __attribute__((packed)) f0; };
```

- CCC: sizeof(S)=8 align=8
- Clang: sizeof(S)=8 align=1

```cpp
// CCC-compiled file: uses its own layout/sizeof for Wrap.
#include

struct S { long __attribute__((packed)) f0; };
struct Wrap { char a; struct S s; unsigned char guard[16]; };

__attribute__((noinline))
void fill_wrap(struct Wrap *w) {
unsigned char *b = (unsigned char *)w;
for (size_t i = 0; i < sizeof(struct Wrap); ++i) {
b[i] = 0x41;
}
}
```

```cpp
// Clang-compiled file: uses its own layout/sizeof for Wrap.
#include
#include

struct S { long __attribute__((packed)) f0; };
struct Wrap { char a; struct S s; unsigned char guard[16]; };

void fill_wrap(struct Wrap *w);

int main(void) {
struct {
struct Wrap w;
unsigned char tail[16];
} box;

memset(&box, 0, sizeof(box));
memset(box.w.guard, 0x42, sizeof(box.w.guard));
memset(box.tail, 0x43, sizeof(box.tail));

fill_wrap(&box.w);

int corrupted = 0;
for (size_t i = 0; i < sizeof(box.w.guard); ++i) {
if (box.w.guard[i] != 0x42) { corrupted = 1; break; }
}
int tail_corrupted = 0;
for (size_t i = 0; i < sizeof(box.tail); ++i) {
if (box.tail[i] != 0x43) { tail_corrupted = 1; break; }
}

printf("clang sizeof(Wrap)=%zu, guard_corrupted=%d, tail_corrupted=%d\n",
sizeof(struct Wrap), corrupted, tail_corrupted);
return (corrupted || tail_corrupted) ? 1 : 0;
}
```

Impact: Real out‑of‑bounds writes when CCC objects are linked with system‑compiler objects, or when packing is required for binary protocols/FFI. This is a correctness and `safety‑critical bug`.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.