Compiler Can Undo Your Security Checks
Chris Domas explains at Black Hat how legal compiler optimizations can strip security checks and memory-clearing operations, turning secure C source into vulnerable binaries.
David Bombal interviews researcher Chris Domas at Black Hat USA 2026 about how the C abstract machine permits compilers to legally transform code in ways that remove security protections, delete memory-clearing operations, and introduce time-of-check to time-of-use vulnerabilities. Factors like register pressure, structure layout, and data size affect vulnerability, with examples where 17 or 33 byte buffers are safe while nearby sizes produce vulnerable code. An AI-assisted analysis of 500 million lines of open-source code identified 300 potentially dangerous patterns. Recommended mitigations include enabling compiler warnings, using sanitizers, analyzing optimized builds, and testing the exact binary that ships.
- Legal compiler optimizations can delete security checks and memory-clearing operations
- Buffer sizes of 17 or 33 bytes can be safe while nearby sizes yield vulnerable binaries
- AI analysis of 500 million open-source lines identified roughly 300 dangerous patterns
- Mitigations: compiler warnings, sanitizers, analyzing optimized builds, testing shipped binaries
- Switching between GCC and Clang or moving to Rust does not fully solve the problem
Full article492 words · extracted from davidbombal.com · click to collapse
Big thanks to @ThreatLocker for sponsoring my trip to Black Hat USA 2026 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal
You can write secure C code, follow accepted best practices and still end up with a vulnerable binary. The reason is simple: the CPU does not run your source code. It runs whatever the compiler produces.
David sits down with security researcher Chris Domas at Black Hat to examine how legal compiler optimizations can remove security protections, delete memory-clearing operations and introduce time-of-check to time-of-use vulnerabilities into code that appeared secure.
Chris explains the C abstract machine, why compilers are allowed to transform code so dramatically and how register pressure, structure layout and even data size can affect whether a binary is vulnerable. In one striking example, 17 or 33 bytes can be safe while nearby sizes produce vulnerable code. They also discuss whether Rust solves the problem, why switching between GCC and Clang is not the answer and how AI helped analyse 500 million lines of open-source code to identify 300 potentially dangerous patterns.
Most importantly, Chris explains what developers can do now, including enabling compiler warnings, using sanitizers, analysing optimized builds and testing the exact binary that will be shipped.
// Christopher Domas’ SOCIAL //
LinkedIn: / christopher-domas
GitHub: https://github.com/xoreaxeaxeax
X: https://x.com/xoreaxeaxeax
// David’s Social //
================
Coect with me:
================
Discord: http://discord.davidbombal.com
X: https://www.x.com/davidbombal
Instagram: https://www.instagram.com/davidbombal
LinkedIn: https://www.linkedin.com/in/davidbombal
Facebook: https://www.facebook.com/davidbombal.co
TikTok: http://tiktok.com/@davidbombal
YouTube Main https://www.youtube.com/davidbombal
YouTube Tech: https://www.youtube.com/chael/UCZTIRrENWr_rjVoA7BcUE_A
YouTube Clips: https://www.youtube.com/chael/UCbY5wGxQgIiAeMdNkW5wM6Q
YouTube Emerging Technologies: https://www.youtube.com/chael/UCbY5wGxQgIiAeMdNkW5wM6Q
YouTube Shorts: https://www.youtube.com/chael/UCEyCubIF0e8MYi1jkgVepKg
Apple Podcast: https://davidbombal.wiki/applepodcast
Spotify Podcast: https://open.spotify.com/show/3f6k6gERfuriI96efWWLQQ
SoundCloud: / davidbombal
================
Support me:
================
Or, buy my CCNA course and support me:
DavidBombal.com: CCNA ($10): http://bit.ly/yt999ccna
Udemy CCNA Course: https://bit.ly/ccnafor10dollars
GNS3 CCNA Course: CCNA ($10): https://bit.ly/gns3ccna10
// MY STUFF //
https://www.amazon.com/shop/davidbombal
// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: [email protected]
// MENU //
0:00 – Coming Up
0:48 – Intro
02:05 – Different Ways of Exploiting CPU’s
04:10 – The C Specifications
06:17 – The Compiler Deleting Nemsec
08:40 – Do we need to use a new Compiler ?
10:09 – Compiler Inventing Vulnerabilities
12:13 – Don’t Give up Writing Secure Code
12:44 – Sponsored Section
14:25 – Any Easy Options To Create A New Compiler ?
15:09 – Chris’s Presentation at Black Hat
20:00 – Weird Situations with Size of Data
21:22 – What Can Developers Do ?
23:32 – Who Can Leverage this Vulnerability ?
25:02 – Could AI Make it Easy For Attackers To Leverage This?
28:27 – Recommendations For Developers
29:48 – Advice To Be Like Chris
30:36 – Conclusion & Outro
Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel!
Disclaimer: This video is for educational purposes only.
#bhusa2026 #securecoding #compiler
Text extracted automatically; images, tables and formatting may be missing. Original: https://davidbombal.com/your-compiler-can-undo-your-security-checks/