Re: Security actions to mitigate future vulnerabilities

2021-09-28 Thread Luís Ferreira via Gcc
On Tue, 2021-09-28 at 19:18 +0100, Jonathan Wakely wrote: > On Tue, 28 Sept 2021 at 18:15, Luís Ferreira > wrote: > > > > On Tue, 2021-09-28 at 17:59 +0100, Jonathan Wakely wrote: > > > On Tue, 28 Sept 2021 at 17:23, Luís Ferreira > > > > > > wrote: > > > > > > > > During my fuzzing test with l

Re: Security actions to mitigate future vulnerabilities

2021-09-28 Thread Jonathan Wakely via Gcc
On Tue, 28 Sept 2021 at 18:15, Luís Ferreira wrote: > > On Tue, 2021-09-28 at 17:59 +0100, Jonathan Wakely wrote: > > On Tue, 28 Sept 2021 at 17:23, Luís Ferreira > > wrote: > > > > > > During my fuzzing test with libfuzzer I found out that GCC is not > > > part > > > of OSS-Fuzz project. Would b

Re: Security actions to mitigate future vulnerabilities

2021-09-28 Thread Luís Ferreira
On Tue, 2021-09-28 at 17:59 +0100, Jonathan Wakely wrote: > On Tue, 28 Sept 2021 at 17:23, Luís Ferreira > wrote: > > > > During my fuzzing test with libfuzzer I found out that GCC is not > > part > > of OSS-Fuzz project. Would be cool to discuss here a bit more about > > fuzzing GCC codebase in

Re: Security actions to mitigate future vulnerabilities

2021-09-28 Thread Jonathan Wakely via Gcc
On Tue, 28 Sept 2021 at 17:23, Luís Ferreira wrote: > > During my fuzzing test with libfuzzer I found out that GCC is not part > of OSS-Fuzz project. Would be cool to discuss here a bit more about > fuzzing GCC codebase in order to mitigate some future vulnerabilities > that may appear. I can volu

Security actions to mitigate future vulnerabilities

2021-09-28 Thread Luís Ferreira
During my fuzzing test with libfuzzer I found out that GCC is not part of OSS-Fuzz project. Would be cool to discuss here a bit more about fuzzing GCC codebase in order to mitigate some future vulnerabilities that may appear. I can volunteer myself to add the necessary steps to fuzz GCC on the OSS

Re: Can gcc itself be tested with ubsan? If so, how?

2021-09-28 Thread Eric Gallager via Gcc
On Tue, Sep 28, 2021 at 2:48 AM Toon Moene wrote: > > On 9/28/21 8:35 AM, Erick Ochoa via Gcc wrote: > > >> Can ubsan be used on the compiler itself? > > I regularly build the compiler(s) natively with ubsan enabled, see for > instance: > > https://gcc.gnu.org/pipermail/gcc-testresults/2021-Septem