1

If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because I am not testing the exact same output/build as the one shipped? Clang has more useful security testing utilities. I understand both implement the C standard but are technically different programs. Please elaborate your answer to include what the specific issues could be.

Improve this question

1 Answer 1

Reset to default
1

Each compiler covers the basics. GCC and Clang also have unique warnings that one compiler does and the others don't. You'll want to turn on as many warnings as possible, treat warnings as errors. Create unit twsts, run ASAN and ThreadSAN, valgrind. Ideally you would run these automatically in CI, even better if you can run all the checks in both compilers. If you have any network or file parsing tunning it through fuzz testing would be good too.

Generally either compiler should be fine, they both implement the C/C++ standards. It's more about code coverage, correct, well written code. The warnings and tests help you get there.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .