[Bug c/49820] Explicit check for integer negative after abs optimized away

["agner at agner dot org" <gcc-bugzilla at gcc dot gnu dot org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49820

--- Comment #15 from Agner Fog <agner at agner dot org> 2011-07-27 14:27:33 UTC ---
How do you define "clever things"? Checking that a variable is within the
allowed range is certainly a standard thing that every SW teacher tells you to
do. I think it is reasonable to expect -Wall to do what it says and set a very
high warning level. Optimizing away an overflow check is such a dangerous thing
to do that it requires a warning.

I think it may be wise to distinguish between optimizing away a whole branch or
loop, versus just making calculations more efficient, e.g. simplifying
expressions or making induction variables. If a branch can be optimized away
then it is either violating the intentions of the programmer or the program has
a logical error. A warning would be in place in either case.

What I am suggesting is that optimizing away a branch should give a warning at
a lower level than simplifying an arithmetic expression. I know this might be
somewhat complicated to implement, but it would be useful for catching the
situation where an overflow check is optimized away.

Checking for overflow in a "safe" way is so complicated and tedious that it is
practically never done (see
https://www.securecoding.cert.org/confluence/display/seccode/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
)

Sorry for being persistent, but I think this issue has serious security
implications.