Article 5TY7P Malcolm: Prevent Trojan Source attacks with GCC 12

Malcolm: Prevent Trojan Source attacks with GCC 12

by
corbet
from LWN.net on (#5TY7P)
David Malcolm describessome GCC improvements to defend against bidirectional-text attacks insource code.

My colleague Marek Polacek and I implemented a new warning for GCC12, -Wbidi-chars, for detecting Trojan Source attacks involvingUnicode control characters. Marek implemented the guts of thewarning, but when I tried it out on the examples provided by theTrojan Source researchers, I found I had trouble understanding theinitial results-precisely because of the obfuscation itself.

So for GCC 12, I've added a new flag to GCC diagnostics, indicatingthat the diagnostic itself relates to source code encoding. Whenany such diagnostic is printed, GCC will now escape non-ASCIIcharacters in the source code.

External Content
Source RSS or Atom Feed
Feed Location http://lwn.net/headlines/rss
Feed Title LWN.net
Feed Link https://lwn.net/
Reply 0 comments