Are Optimization Flags Harmful?

Question

There seems to be a consensus, that

-D_FORTIFY_SOURCE=2 -O1

is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report.

What I'm confused about is, that _FORTIFY_SOURCE=2 needs an optimizer flag, despite the fact, that - at least according to this bug report - it can have security implications.

I have too little understanding to understand the gravity of -O1 on the security.

Can someone please shed some light on why -O1 is problem (preferably also how this can be mitigated) or why this is not a problem? Also if it has both sides, what would be the factors to consider?

Answer 1

In the bug report you linked, the developer tries to overwrite the password in memory. This changes only the memory contents and has no other side effects.

An optimizing compiler may change the code in any way it likes as long as it does not change the behavior of the program. The behavior of the program is its input and output, but not its memory contents. So if you overwrite a password in memory, the compiler is free to remove that, since removing it has no effect on the working of the program.

I think as a developer you need to accept the fact that you have no control over the memory contents, instead of fighting the compiler.