{"id":"https://openalex.org/W3025058513","doi":"https://doi.org/10.1145/3485531","title":"Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets","display_name":"Not so fast: understanding and mitigating negative impacts of compiler optimizations on code reuse gadget sets","publication_year":2021,"publication_date":"2021-10-15","ids":{"openalex":"https://openalex.org/W3025058513","doi":"https://doi.org/10.1145/3485531","mag":"3025058513"},"language":"en","primary_location":{"id":"doi:10.1145/3485531","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3485531","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3485531","source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3485531","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Michael D. Brown","orcid":"https://orcid.org/0000-0002-5289-0856"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Michael D. Brown","raw_affiliation_strings":["Georgia Institute of Technology, USA"],"raw_orcid":"https://orcid.org/0000-0002-5289-0856","affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Matthew Pruett","orcid":null},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Matthew Pruett","raw_affiliation_strings":["Georgia Institute of Technology, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Robert Bigelow","orcid":null},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Robert Bigelow","raw_affiliation_strings":["Georgia Institute of Technology, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Girish Mururu","orcid":null},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Girish Mururu","raw_affiliation_strings":["Georgia Institute of Technology, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"last","author":{"id":null,"display_name":"Santosh Pande","orcid":null},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Santosh Pande","raw_affiliation_strings":["Georgia Institute of Technology, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, USA","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I130701444"],"apc_list":null,"apc_paid":null,"fwci":0.6996,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.74958225,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"5","issue":"OOPSLA","first_page":"1","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8043000102043152,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8043000102043152,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.0934000015258789,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10126","display_name":"Logic, programming, and type systems","score":0.03200000151991844,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/gadget","display_name":"Gadget","score":0.7782999873161316},{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.7728999853134155},{"id":"https://openalex.org/keywords/optimizing-compiler","display_name":"Optimizing compiler","score":0.6184999942779541},{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.597100019454956},{"id":"https://openalex.org/keywords/dead-code-elimination","display_name":"Dead code elimination","score":0.5756999850273132},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.5616000294685364},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.5213000178337097},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5016999840736389},{"id":"https://openalex.org/keywords/code-reuse","display_name":"Code reuse","score":0.4984000027179718}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8689000010490417},{"id":"https://openalex.org/C119770614","wikidata":"https://www.wikidata.org/wiki/Q5516347","display_name":"Gadget","level":2,"score":0.7782999873161316},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.7728999853134155},{"id":"https://openalex.org/C190902152","wikidata":"https://www.wikidata.org/wiki/Q1325106","display_name":"Optimizing compiler","level":3,"score":0.6184999942779541},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.597100019454956},{"id":"https://openalex.org/C2144512","wikidata":"https://www.wikidata.org/wiki/Q1143090","display_name":"Dead code elimination","level":5,"score":0.5756999850273132},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5616000294685364},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.5213000178337097},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5016999840736389},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.4984000027179718},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.4844000041484833},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.4772999882698059},{"id":"https://openalex.org/C128916667","wikidata":"https://www.wikidata.org/wiki/Q1343660","display_name":"Register allocation","level":3,"score":0.4429999887943268},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.40230000019073486},{"id":"https://openalex.org/C139571649","wikidata":"https://www.wikidata.org/wiki/Q1156793","display_name":"Program optimization","level":3,"score":0.4011000096797943},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.3190999925136566},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C173608175","wikidata":"https://www.wikidata.org/wiki/Q232661","display_name":"Parallel computing","level":1,"score":0.30959999561309814},{"id":"https://openalex.org/C63000827","wikidata":"https://www.wikidata.org/wiki/Q3080428","display_name":"Software portability","level":2,"score":0.30869999527931213},{"id":"https://openalex.org/C92966194","wikidata":"https://www.wikidata.org/wiki/Q651794","display_name":"Compiled language","level":4,"score":0.29580000042915344},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C195701839","wikidata":"https://www.wikidata.org/wiki/Q4008398","display_name":"Partial evaluation","level":2,"score":0.2574000060558319},{"id":"https://openalex.org/C63435697","wikidata":"https://www.wikidata.org/wiki/Q864135","display_name":"Binary code","level":3,"score":0.2572000026702881},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.25440001487731934},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3485531","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3485531","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3485531","source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2005.08363","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2005.08363","pdf_url":"https://arxiv.org/pdf/2005.08363","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.5281/zenodo.5424843","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.5424843","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article-journal"},{"id":"doi:10.5281/zenodo.5424844","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.5424844","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.1145/3485531","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3485531","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3485531","source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3025058513.pdf","grobid_xml":"https://content.openalex.org/works/W3025058513.grobid-xml"},"referenced_works_count":28,"referenced_works":["https://openalex.org/W1515653707","https://openalex.org/W1680927362","https://openalex.org/W1969501726","https://openalex.org/W1982829328","https://openalex.org/W1984187936","https://openalex.org/W1996931407","https://openalex.org/W2001978806","https://openalex.org/W2026438857","https://openalex.org/W2027963645","https://openalex.org/W2072102701","https://openalex.org/W2074943483","https://openalex.org/W2121468041","https://openalex.org/W2152644030","https://openalex.org/W2153185479","https://openalex.org/W2162800072","https://openalex.org/W2460660454","https://openalex.org/W2612418998","https://openalex.org/W2766313665","https://openalex.org/W2766473379","https://openalex.org/W2773049795","https://openalex.org/W2897147955","https://openalex.org/W2901397262","https://openalex.org/W2949255524","https://openalex.org/W2978627403","https://openalex.org/W3012221736","https://openalex.org/W3033425067","https://openalex.org/W4247335479","https://openalex.org/W4285362543"],"related_works":[],"abstract_inverted_index":{"Despite":[0],"extensive":[1],"testing":[2],"and":[3,71,81,123,138,161,169,181,219,251],"correctness":[4],"certification":[5],"of":[6,12,52,83,110,113,127,212],"their":[7,143],"functional":[8],"semantics,":[9],"a":[10,45,108,178],"number":[11],"compiler":[13,53,77,114,172],"optimizations":[14,35,54,173],"have":[15],"been":[16],"shown":[17],"to":[18,140,158,192,223],"violate":[19],"security":[20,39,59],"guarantees":[21],"implemented":[22],"in":[23,153,197,245],"source":[24],"code.":[25,199],"While":[26],"prior":[27],"work":[28],"has":[29],"shed":[30],"light":[31],"on":[32,55,116],"how":[33,68,142],"such":[34,96],"may":[36],"introduce":[37,174],"semantic":[38],"weaknesses":[40],"into":[41],"programs,":[42],"there":[43],"remains":[44],"significant":[46],"knowledge":[47],"gap":[48,106],"concerning":[49],"the":[50,76,79,111,147,210],"impacts":[51,112],"non-semantic":[56],"properties":[57],"with":[58,133,156,240,248],"implications.":[60],"In":[61,100,215,227],"particular,":[62,228],"little":[63],"is":[64],"currently":[65],"known":[66],"about":[67],"code":[69,85,92,117,148,183,247],"generation":[70],"optimization":[72,115,144],"decisions":[73],"made":[74],"by":[75],"affect":[78,146],"availability":[80],"utility":[82],"reusable":[84],"segments":[86],"called":[87],"gadgets":[88,176],"required":[89],"for":[90],"implementing":[91],"reuse":[93,118,149],"attack":[94],"methods":[95],"as":[97],"return-oriented":[98],"programming.":[99],"this":[101,105,213],"paper,":[102],"we":[103,204,217,229],"bridge":[104],"through":[107],"study":[109,165],"gadget":[119,150,185,254],"sets.":[120,255],"We":[121],"analyze":[122],"compare":[124],"1,187":[125],"variants":[126,155],"20":[128],"different":[129],"benchmark":[130],"programs":[131],"built":[132],"two":[134],"production":[135],"compilers":[136],"(GCC":[137],"Clang)":[139],"determine":[141],"behaviors":[145,208,239],"sets":[151,186],"present":[152],"program":[154],"respect":[157],"both":[159],"quantitative":[160],"qualitative":[162],"metrics.":[163],"Our":[164],"exposes":[166],"an":[167,193],"important":[168],"unexpected":[170],"problem;":[171],"new":[175],"at":[177,209],"high":[179],"rate":[180],"produce":[182],"containing":[184],"that":[187,231],"are":[188],"generally":[189],"more":[190],"useful":[191,253],"attacker":[194],"than":[195],"those":[196],"unoptimized":[198],"Using":[200],"differential":[201],"binary":[202,233],"analysis,":[203],"identify":[205],"several":[206,221],"undesirable":[207],"root":[211],"phenomenon.":[214],"turn,":[216],"propose":[218],"evaluate":[220],"strategies":[222],"mitigate":[224,237],"these":[225,238],"behaviors.":[226],"show":[230],"post-production":[232],"recompilation":[234],"can":[235],"effectively":[236],"negligible":[241],"performance":[242],"impacts,":[243],"resulting":[244],"optimized":[246],"significantly":[249],"smaller":[250],"less":[252]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":3}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2020-05-21T00:00:00"}