Security vulernarability or security feature?

[NightStrike]

On 4/24/08, Robert C. Seacord <rcs@cert.org> wrote:
> If you are referring to VU#694123, this refers to an optimization that
> removes checks pointer arithmetic wrapping.  The optimization doesn't
> actually eliminate the wrapping behavior; this still occurs.  It does,
> however, eliminate certain kinds of checks (that depend upon undefined
> behavior).

How can you hold the compiler responsible for code that depends on
undefined behavior?  The behavior is undefined, therefore you CANNOT
depend on it.


If you buy a hammer that says on it "for use in hammering nails," and
you use it to hammer in a screw, and it fails miserably (as hammering
screws is undefined behavior), is it the hammer manufacturer's fault
for not telling you about every single possible scenario in which a
hammer cannot be used?