schrodingers-toctou: The binary you run is not the program you wrote

Compilers can rewrite source code in ways that may introduce vulnerabilities, such as time-of-check to time-of-use (TOCTOU) bugs. These vulnerabilities occur when a program checks the validity of a value and then uses that value, but an attacker can change the value in between the check and the use. The issue arises because the compiler may insert an extra load of the value, even if it was not explicitly written in the source code.

This can lead to the validation of a safe value while the actual value used in the program is different and potentially malicious. To mitigate this, developers should snapshot and validate any potentially tampered data before using it, ensuring that only the validated copy is used in subsequent operations. However, even this approach may not be foolproof, as compilers can still introduce invented loads that reintroduce the TOCTOU vulnerability.

The only reliable way to determine if a particular piece of code is vulnerable is to build and test it, as the behavior can change based on the compiler version, target architecture, and compiler flags used during compilation.