Skip to main content

Get a free FHIR vulnerability scan, funded by Cantina.
All disclosures

Vulnerability disclosure

Dropped tag binding can produce the wrong C struct layout

COMPCERT-0375C18

Affected product
CompCert
Severity
Medium
Weakness
CWE-682
Disclosed

Summary

The C elaborator could discard a tag binding introduced inside an initializer and build the wrong AST for a well-defined program.

Technical analysis

The accompanying research article explains the finding, reproduction, and remediation status.

Read the technical write-up

Disclosure timeline

Public disclosure

Credits

Cantina · Agent-discovered and human-verified

References