anthropics / anthropics/claudes-c-compiler
[SECURITY] CCC ignores per‑field __attribute__((packed)), causing ABI/layout mismatch and memory corruption
- Lingua principale
- Rust
- Stelle
- 2.8k
- Fork
- 247
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
CCC does not honor per‑field __attribute__((packed)), producing incorrect alignment and layout. This breaks ABI compatibility with GCC/Clang and causes real out‑of‑bounds writes across translation units.
Minimal Example
```cpp
struct S { long __attribute__((packed)) f0; };
```
- CCC: sizeof(S)=8 align=8
- Clang: sizeof(S)=8 align=1
```cpp
// CCC-compiled file: uses its own layout/sizeof for Wrap.
#include
struct S { long __attribute__((packed)) f0; };
struct Wrap { char a; struct S s; unsigned char guard[16]; };
__attribute__((noinline))
void fill_wrap(struct Wrap *w) {
unsigned char *b = (unsigned char *)w;
for (size_t i = 0; i < sizeof(struct Wrap); ++i) {
b[i] = 0x41;
}
}
```
```cpp
// Clang-compiled file: uses its own layout/sizeof for Wrap.
#include
#include
struct S { long __attribute__((packed)) f0; };
struct Wrap { char a; struct S s; unsigned char guard[16]; };
void fill_wrap(struct Wrap *w);
int main(void) {
struct {
struct Wrap w;
unsigned char tail[16];
} box;
memset(&box, 0, sizeof(box));
memset(box.w.guard, 0x42, sizeof(box.w.guard));
memset(box.tail, 0x43, sizeof(box.tail));
fill_wrap(&box.w);
int corrupted = 0;
for (size_t i = 0; i < sizeof(box.w.guard); ++i) {
if (box.w.guard[i] != 0x42) { corrupted = 1; break; }
}
int tail_corrupted = 0;
for (size_t i = 0; i < sizeof(box.tail); ++i) {
if (box.tail[i] != 0x43) { tail_corrupted = 1; break; }
}
printf("clang sizeof(Wrap)=%zu, guard_corrupted=%d, tail_corrupted=%d\n",
sizeof(struct Wrap), corrupted, tail_corrupted);
return (corrupted || tail_corrupted) ? 1 : 0;
}
```
Impact: Real out‑of‑bounds writes when CCC objects are linked with system‑compiler objects, or when packing is required for binary protocols/FFI. This is a correctness and `safety‑critical bug`.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.