[tor-bugs] #12418 [Tor bundles/installation]: TBBs with UBSan create lots of errors when running

[Tor Bug Tracker & Wiki]

#12418: TBBs with UBSan create lots of errors when running
------------------------------------------+--------------------------
     Reporter:  gk                        |      Owner:  erinn
         Type:  defect                    |     Status:  new
     Priority:  normal                    |  Milestone:
    Component:  Tor bundles/installation  |    Version:
   Resolution:                            |   Keywords:  tbb-security
Actual Points:                            |  Parent ID:  #10599
       Points:                            |
------------------------------------------+--------------------------

Comment (by gk):

 {{{
 09:06 < GeKo> oh, btw. are you running (semi-)regular UBSan builds as
 well? I am
               getting loads of "runtime error: load of value X, which is
 not a value
               for type Y" errors.
 09:06 < decoder> no, im not. the problem with ubsan is that most errors it
 reports
                  are likely not going to be fixed by developers
 09:07 < decoder> it's really hard to reason with devs about fixing those
 09:07 < GeKo> ugh
 09:07 < decoder> in some cases (e.g. signed overflows, float overflows, in
 layout/)
                  developers said it's well known and wont be fixed
 09:07 < decoder> the whole layout/ engine does signed overflows all the
 time and
                  doesnt care about the result
 09:08 < decoder> they say worst thing that can happen is wrong layouting
 09:08 < GeKo> :(
 09:09 < decoder> GeKo: ive found signed overflows before though with
 ubsan, that had
                  a certain security impact
 09:09 < decoder> problem is, with all those messages from layout/ and some
 other
                  components that we need to ignore, we need a working
 blacklist
                  mechanism
 09:10 < decoder> so we can ignore those problems
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12418#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online