Show Notes

168 - Exploiting Undefined Behavior and a Chrome UAF

No specific issue here just talking about what divergent representations are.

A divergent representation occurs when a compiler applies program optimizations that cause a single source variable to be represented with different semantics in the output program.

Or in a more concrete sense where:

int index_of(char *buf, char target) {
    int i;
    for (i=0; buf[i] != target; i++) {}
    return i;
/* ... */
buf[index_of(buf, target)] == target

Where the condition can be false because of having divergent representations of i in index of. Which is what happens when compiled wiht -O1 and above.