> The practical effect of this security bug is quite limited.
You are probably correct (although it's hard to say for sure that you've considered every single compiler optimization).
But even if you are correct, the point of the parent poster still stands:
> something that triggers undefined behavior in C is not to be dismissed as lightly as the article is doing.
I agree with this.
Notice how long your explanation was. The author of the article did not provide a similar explanation, or even an abbreviated one, in order to justify the claims that the bug does not have security implications. In fact, the author didn't even have to provide such an explanation, but he could have at least acknowledged the possibility, which could then be argued to be dismissable based on his (extensive) experience.
I'm not saying that there are security implications or that the burden of proving that there aren't any is on the author of the article.
I'm only agreeing with the parent poster that you cannot easily or simply claim that the bug is not a security vulnerability, without giving some consideration to the possible impact of UB, or at least acknowledging the possibility.
Not acknowledging this possible impact can in fact reinforce misconceptions about the security implications of bugs in C code that lead to UB.
You are probably correct (although it's hard to say for sure that you've considered every single compiler optimization).
But even if you are correct, the point of the parent poster still stands:
> something that triggers undefined behavior in C is not to be dismissed as lightly as the article is doing.
I agree with this.
Notice how long your explanation was. The author of the article did not provide a similar explanation, or even an abbreviated one, in order to justify the claims that the bug does not have security implications. In fact, the author didn't even have to provide such an explanation, but he could have at least acknowledged the possibility, which could then be argued to be dismissable based on his (extensive) experience.
I'm not saying that there are security implications or that the burden of proving that there aren't any is on the author of the article.
I'm only agreeing with the parent poster that you cannot easily or simply claim that the bug is not a security vulnerability, without giving some consideration to the possible impact of UB, or at least acknowledging the possibility.
Not acknowledging this possible impact can in fact reinforce misconceptions about the security implications of bugs in C code that lead to UB.