{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:15:05Z","timestamp":1783008905867,"version":"3.54.5"},"reference-count":20,"publisher":"Association for Computing Machinery (ACM)","issue":"PLDI","license":[{"start":{"date-parts":[[2023,6,6]],"date-time":"2023-06-06T00:00:00Z","timestamp":1686009600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2023,6,6]]},"abstract":"<jats:p>Sanitizers are widely used compiler features that detect undefined behavior and resulting vulnerabilities by injecting runtime checks into programs. For better performance, sanitizers are often used in conjunction with optimization passes. But doing so combines two compiler features with conflicting objectives. While sanitizers want to expose undefined behavior, optimizers often exploit these same properties for performance. In this paper, we show that this clash can have serious consequences: optimizations can remove sanitizer failures, thereby hiding the presence of bugs or even introducing new ones.<\/jats:p>\n          <jats:p>We present LookUB, a differential-testing based framework for finding optimizer transformations that elide sanitizer failures. We used our method to find 17 such sanitizer-eliding optimizations in Clang. Next, we used static analysis and fuzzing to search for bugs in open-source projects that were previously hidden due to sanitizer-eliding optimizations. This led us to discover 20 new bugs in Linux Containers, libmpeg2, NTFS-3G, and WINE. Finally, we present an effective mitigation strategy based on a customization of the Clang optimizer with an overhead increase of 4%.<\/jats:p>","DOI":"10.1145\/3591257","type":"journal-article","created":{"date-parts":[[2023,6,6]],"date-time":"2023-06-06T20:06:24Z","timestamp":1686081984000},"page":"907-927","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Don\u2019t Look UB: Exposing Sanitizer-Eliding Compiler Optimizations"],"prefix":"10.1145","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-6224-9795","authenticated-orcid":false,"given":"Raphael","family":"Isemann","sequence":"first","affiliation":[{"name":"Vrije Universiteit Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8329-5929","authenticated-orcid":false,"given":"Cristiano","family":"Giuffrida","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6179-1510","authenticated-orcid":false,"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0312-9913","authenticated-orcid":false,"given":"Erik","family":"van der Kouwe","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0826-4425","authenticated-orcid":false,"given":"Klaus von","family":"Gleissenthall","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,6,6]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446695"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.5281\/zenodo.7684001"},{"key":"e_1_2_1_3_1","volume-title":"FuZZan: Efficient Sanitizer Metadata Design for Fuzzing. In 2020 USENIX Annual Technical Conference (USENIX ATC 20)","author":"Jeon Yuseok","year":"2020","unstructured":"Yuseok Jeon , WookHyun Han , Nathan Burow , and Mathias Payer . 2020 . FuZZan: Efficient Sanitizer Metadata Design for Fuzzing. In 2020 USENIX Annual Technical Conference (USENIX ATC 20) . USENIX Association, 249\u2013263. isbn:978-1-939133-14-4 https:\/\/www.usenix.org\/conference\/atc20\/presentation\/jeon Yuseok Jeon, WookHyun Han, Nathan Burow, and Mathias Payer. 2020. FuZZan: Efficient Sanitizer Metadata Design for Fuzzing. In 2020 USENIX Annual Technical Conference (USENIX ATC 20). USENIX Association, 249\u2013263. isbn:978-1-939133-14-4 https:\/\/www.usenix.org\/conference\/atc20\/presentation\/jeon"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/TAIC-PART.2008.18"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594334"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3428264"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1273442.1250746"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSTW.2018.00026"},{"key":"e_1_2_1_9_1","volume-title":"OSS-Fuzz - Google","author":"Serebryany Kostya","unstructured":"Kostya Serebryany . 2017. OSS-Fuzz - Google \u2019 s continuous fuzzing service for open source software. USENIX Association , Vancouver, BC . Kostya Serebryany. 2017. OSS-Fuzz - Google\u2019 s continuous fuzzing service for open source software. USENIX Association, Vancouver, BC."},{"key":"e_1_2_1_10_1","volume-title":"AddressSanitizer: A Fast Address Sanity Checker. In 2012 USENIX Annual Technical Conference (USENIX ATC 12)","author":"Serebryany Konstantin","year":"2012","unstructured":"Konstantin Serebryany , Derek Bruening , Alexander Potapenko , and Dmitriy Vyukov . 2012 . AddressSanitizer: A Fast Address Sanity Checker. In 2012 USENIX Annual Technical Conference (USENIX ATC 12) . USENIX Association, Boston, MA. 309\u2013318. isbn:978-93 1971-93-5 https:\/\/www.usenix.org\/conference\/atc12\/technical-sessions\/presentation\/serebryany Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. In 2012 USENIX Annual Technical Conference (USENIX ATC 12). USENIX Association, Boston, MA. 309\u2013318. isbn:978-931971-93-5 https:\/\/www.usenix.org\/conference\/atc12\/technical-sessions\/presentation\/serebryany"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00010"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2015.7054186"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.58"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2349896.2349905"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2517349.2522728"},{"key":"e_1_2_1_16_1","article-title":"Busybox: A swiss army knife for linux","volume":"2000","author":"Wells Nicholas","year":"2000","unstructured":"Nicholas Wells . 2000 . Busybox: A swiss army knife for linux . Linux Journal , 2000 , 78es (2000), 10\u2013es. Nicholas Wells. 2000. Busybox: A swiss army knife for linux. Linux Journal, 2000, 78es (2000), 10\u2013es.","journal-title":"Linux Journal"},{"key":"e_1_2_1_17_1","unstructured":"Zekai Wu Wei Liu Mingyue Liang and Kai Song. 2020. Finding Bugs Compiler Knows but Doesn\u2019t Tell You: Dissecting Undefined Behavior Optimizations in LLVM. BlackHat Europe \t\t\t\t  Zekai Wu Wei Liu Mingyue Liang and Kai Song. 2020. Finding Bugs Compiler Knows but Doesn\u2019t Tell You: Dissecting Undefined Behavior Optimizations in LLVM. BlackHat Europe"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1993498.1993532"},{"key":"e_1_2_1_19_1","volume-title":"15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21)","author":"Zhang Jiang","year":"2021","unstructured":"Jiang Zhang , Shuai Wang , Manuel Rigger , Pinjia He , and Zhendong Su . 2021 . SANRAZOR: Reducing Redundant Sanitizer Checks in C\/C++ Programs . In 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21) . USENIX Association, 479\u2013494. isbn:978-1-939133-22-9 https:\/\/www.usenix.org\/conference\/osdi21\/presentation\/zhang Jiang Zhang, Shuai Wang, Manuel Rigger, Pinjia He, and Zhendong Su. 2021. SANRAZOR: Reducing Redundant Sanitizer Checks in C\/C++ Programs. In 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21). USENIX Association, 479\u2013494. isbn:978-1-939133-22-9 https:\/\/www.usenix.org\/conference\/osdi21\/presentation\/zhang"},{"key":"e_1_2_1_20_1","volume-title":"Debloating Address Sanitizer. In 31st USENIX Security Symposium (USENIX Security 22)","author":"Zhang Yuchen","year":"2022","unstructured":"Yuchen Zhang , Chengbin Pang , Georgios Portokalidis , Nikos Triandopoulos , and Jun Xu . 2022 . Debloating Address Sanitizer. In 31st USENIX Security Symposium (USENIX Security 22) . USENIX Association, Boston, MA. 4345\u20134363. isbn:978-1-939133-31-1 https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zhang-yuchen Yuchen Zhang, Chengbin Pang, Georgios Portokalidis, Nikos Triandopoulos, and Jun Xu. 2022. Debloating Address Sanitizer. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA. 4345\u20134363. isbn:978-1-939133-31-1 https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zhang-yuchen"}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3591257","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3591257","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:47:47Z","timestamp":1750178867000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3591257"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,6]]},"references-count":20,"journal-issue":{"issue":"PLDI","published-print":{"date-parts":[[2023,6,6]]}},"alternative-id":["10.1145\/3591257"],"URL":"https:\/\/doi.org\/10.1145\/3591257","relation":{},"ISSN":["2475-1421"],"issn-type":[{"value":"2475-1421","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,6,6]]},"assertion":[{"value":"2023-06-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}