Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [compiler]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
362 views

Is there a secure way to embed a private key in compiled code that is released in compiled form to the general public?

It occurred to me that if I could compile a private key in source code, I could prove that log information came exclusively from the application for a given version. I could do this by releasing the ...
Larry Freeman's user avatar
1 vote
1 answer
100 views

Is switching my C/C++ compiler for security testing generally reliable?

If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
the_endian's user avatar
  • 1,179
1 vote
1 answer
243 views

Vulnerabilities in Build-time Libraries Could be a Security Threat

If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
Mjina's user avatar
  • 111
1 vote
1 answer
423 views

Can I get viruses from compiling C# code?

I have found a tool that requires me to compile it with Visual Studio. I am not sure if I can do it without the risk of malicious software being installed during the compiling process. Is that ...
kol99d's user avatar
  • 11
1 vote
0 answers
126 views

Compiler that adds machine info to binary

Wanted to ask if there is any compiler (any known programming language) that is actually encoding machine data into binary, so it is possible to detect the machine where the program has been compiled (...
Bojan Vukasovic's user avatar
2 votes
1 answer
307 views

How do I compare the safety of a compiled program with optimization flag?

I would like to know how I can know which is the safest compilation line, that is: Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
sgio's user avatar
  • 21
2 votes
1 answer
355 views

Does recompiling a binary from source code make it more secure/obscure?

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...
plsrespond's user avatar
4 votes
2 answers
325 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
stevec's user avatar
  • 1,280
3 votes
0 answers
186 views

Compiler-induced information leaks/side-channels in cryptography implementations

In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits. ...
Albert Gomà's user avatar
1 vote
1 answer
193 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
nowox's user avatar
  • 367
1 vote
1 answer
265 views

What evidence does a compiled file leave behind?

I was wondering when people compile malware and use the compiled files for engagements or nefarious purposes, what evidence do they leave behind in the compiled Windows executables? I have heard that ...
Vilius Povilaika's user avatar
2 votes
1 answer
5k views

Program compiled with mingw32 is reported as infected

I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), ...
Tal Cohen's user avatar
2 votes
2 answers
179 views

Does removing features from a library increase or reduce security risks?

Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
TZubiri's user avatar
  • 113
1 vote
1 answer
1k views

Are compilers safe?

I was wondering about how compilers like GCC compile themselves after each release but that got me thinking: Are compilers safe? Correct me if I'm wrong, but even if at one step along the way a ...
Xosrov's user avatar
  • 113
1 vote
1 answer
586 views

Avast antivirus virus alarm while programming [closed]

I was programming a function pointer in C on CodeBlocks. When I compiled and ran it, Avast showed an alert message and quarantined the .exe. Is there a solution? Or do I need to disable Avast while ...
anonymous's user avatar
3 votes
1 answer
770 views

How is compiling a program from source more secure?

When downloading compiled binaries for programs it is very important to check GPG signatures, Authenticode, hashes, etc. However, I often see people who say that compiling the code from source is the ...
rubberband876's user avatar
5 votes
1 answer
4k views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
esote's user avatar
  • 373
0 votes
1 answer
232 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
Stack Tracer's user avatar
5 votes
1 answer
1k views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...
forest's user avatar
  • 66.8k
2 votes
1 answer
4k views

Does Java anti-decompiler software really work as claimed?

BIS Guard's Java Antidecompiler is an application that you can purchase that claims: Java Antidecompiler protects java byte-code against decompilers, any binary viewers/editors, prevents reverse ...
User's user avatar
  • 33
0 votes
1 answer
185 views

Building software safely for malware-free distribution

I wrote a program. I want to publish a compiled executable for downloading by the public. How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
7vujy0f0hy's user avatar
1 vote
2 answers
249 views

What are the security trade-offs of using reproducible builds?

From reproducible-builds.org: Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers. In ...
Philipp Claßen's user avatar
0 votes
1 answer
292 views

Lynis Indicates Compilers

On a droplet, when Lynis reports that compilers have been found, I've been unable to determine which compilers it means exactly. I'd like to remove these. How can I? There is another thread, but the "...
JohnFF's user avatar
  • 144
2 votes
2 answers
1k views

Should programs check for symlinks before creating files?

We received a bug report (phrased as a security issue) for a program, which stated that when the program creates files on disk, it does not first verify if a symbolic link exists at the file path to ...
Vladimir Panteleev's user avatar
1 vote
1 answer
197 views

Extreme buffer size consequences

What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
Us3rname's user avatar
  • 131
0 votes
1 answer
265 views

Are Optimization Flags Harmful?

There seems to be a consensus, that -D_FORTIFY_SOURCE=2 -O1 is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report. What I'm ...
user857990's user avatar
40 votes
3 answers
6k views

What security measure one should implement before executing user uploaded files?

I want to make a little programming puzzle on my website. There's going to be a task. The user will be asked to upload a C++ source file with their solution. The file should be compiled, run with some ...
Jen's user avatar
  • 503
-2 votes
1 answer
1k views

How to secure batch script with compiler (not compressor) in Windows?

Batch script, a.k.a. bat or cmd, is good - easy to learn, easy to code, easy to use, easy to distrubute. However it lets coders down when they need to achieve something complex in batch script. The ...
ll55's user avatar
  • 103
2 votes
5 answers
8k views

How do I harden compilers (as suggested by Lynis)?

This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web. ii g++ 4:5.3.1-1ubuntu1 ...
forthrin's user avatar
  • 1,811
5 votes
4 answers
3k views

Should I compile as root?

When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account? ./configure ...
joeytwiddle's user avatar
2 votes
0 answers
177 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
makerofthings7's user avatar
8 votes
1 answer
699 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
makerofthings7's user avatar
1 vote
2 answers
205 views

Can pre-compiled binaries be different than if someone builds from source himself?

Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for ...
Mars's user avatar
  • 1,843
7 votes
2 answers
3k views

How do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
user775093's user avatar
4 votes
2 answers
837 views

Are compiler options relevant to C# security? If so, which options?

It is normal to list some extra-secure compiler options to prevent attacks on C and C++. However, I have not found any similar recommendations for C#. Are compiler options simply not relevant to C# ...
MrSynAckSter's user avatar
  • 2,040
81 votes
10 answers
19k views

Would it be good secure programming practice to overwrite a "sensitive" variable before deleting it?

Is it good secure programming practice to overwrite sensitive data stored in a variable before it is deleted (or goes out of scope)? My thought is that it would prevent a hacker from being able to ...
Jonathan's user avatar
  • 3,185
3 votes
1 answer
200 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
debray's user avatar
  • 133
-1 votes
1 answer
4k views

Compilation Error "fatal error: openssl rc4.h: No such file or directory" [closed]

I am trying to compile the following exploit http://pastebin.com/pxy4GiFQ to use it against one of my lab machines. I am trying to compile it inside KALI machine and get the following error: root@...
Ahmed Taher's user avatar
1 vote
1 answer
4k views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
Ahmed Taher's user avatar
0 votes
1 answer
133 views

What's the point of storing an copy of args? (the /gs flag)

When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable. So, what's the point of keeping a copy of arg?
daisy's user avatar
  • 2,077
7 votes
2 answers
2k views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
makerofthings7's user avatar
3 votes
2 answers
850 views

Are .NET project GUID's visible when compiling?

I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine. In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
user avatar